API User
Overview
The API User feature allows administrators to create and manage credentials that can be used by applications, services, scripts, or third-party systems when accessing the OneDB API.
Each API User is assigned a unique API Secret that is used for authentication. API secrets are securely stored as hashes and cannot be viewed again after creation. For security reasons, the secret must be copied and stored safely when it is first generated.
API Users can also be restricted to specific client IP addresses or network ranges, providing an additional layer of access control.
Key Features
- Create dedicated API credentials for applications and integrations
- Generate secure API secrets
- Restrict access by IP address or CIDR range
- Enable or disable API users without deleting them
- Track the last usage timestamp
- Store API secrets securely using one-way hashing
- Separate API authentication from standard OneDB user accounts
Creating an API User
Navigate to:
User Management → API User
Click Add API Credential.
Configuration Fields
| Field | Description |
|---|---|
| API Username | Unique identifier used by the application. |
| Description | Optional description of the API user or integration purpose. |
| Allowed Client Addresses | Optional list of IP addresses or CIDR ranges allowed to use this credential. |
| API Secret | Secret key used for API authentication. |
| Active | Enables or disables the API credential. |
Allowed Client Addresses
The Allowed Client Addresses field can be used to restrict API access to specific systems.
Examples:
10.10.10.5Single IP address.
10.10.20.0/24Entire subnet.
10.10.10.5
10.10.20.0/24
192.168.1.100Multiple entries can be configured.
If this field is left empty, the API credential may be used from any client address.
Generating an API Secret
Click Generate to create a secure API secret.
After generation, OneDB displays the secret once.
Important
The generated secret is shown only during creation.
Once saved:
- The secret is hashed before being stored.
- The original value cannot be retrieved.
- Administrators must generate a new secret if the existing secret is lost.
Secret Creation Confirmation
After a secret is generated, OneDB displays a confirmation dialog containing the new secret.
Best Practice:
- Copy the secret immediately.
- Store it in a secure password vault or secrets manager.
- Avoid sharing secrets through email or chat systems.
Managing API Users
The API User Management page provides an overview of all configured API credentials.
Available information includes:
| Column | Description |
|---|---|
| Created Date | When the credential was created |
| Username | API username |
| Description | Integration description |
| Status | Active or Inactive |
| Last Used | Most recent successful API usage |
| Actions | Edit, Enable/Disable, or Delete |
Disabling an API User
An API credential can be temporarily disabled without deleting it.
When disabled:
- Authentication requests using the credential are rejected.
- Existing applications can no longer access OneDB APIs.
- The credential configuration remains available for future reactivation.
This approach is useful for maintenance activities, testing, or temporary access suspension.
Security Recommendations
Use Dedicated Credentials
Create separate API Users for different applications rather than sharing a single credential across multiple systems.
Restrict Client Addresses
Whenever possible, configure allowed IP addresses to reduce unauthorized access risks.
Rotate Secrets Periodically
Regularly generate new API secrets and update connected applications.
Protect Secrets
Store API secrets in:
- Enterprise password managers
- Secret management systems
- Secure application configuration stores
Avoid:
- Source code repositories
- Shared spreadsheets
- Plain text configuration files
Disable Unused Credentials
Remove or disable credentials that are no longer required.
Example Use Cases
Payment Application
Username: payment-api
Description: Payment processing integration
Allowed Client Address: 10.10.10.5Data Synchronization Service
Username: sync-service
Description: Customer data synchronization
Allowed Client Address: 10.20.0.0/24Internal Reporting System
Username: reporting-api
Description: Business intelligence reporting
Allowed Client Address: 192.168.1.100Best Practices
- Create a unique API User for each application.
- Restrict access using client IP filtering.
- Store API secrets securely.
- Rotate credentials periodically.
- Review API User activity regularly.
- Disable unused credentials immediately.
- Never share API secrets between multiple teams or applications.
The API User feature provides a secure and manageable way to authenticate applications accessing the OneDB API while maintaining centralized control over API access.
