1. System API Key

System API Keys are created and managed from the System Platform. They are used to issue access credentials for a specific organization and a specific user.

They differ from personal API Keys: a personal API Key can only be created and managed by the current user for themselves; a System API Key is issued by a system administrator after selecting a tenant and user.

1.1. Create a Key

1. Open the API Key page in System Platform.
2. Select an organization. The user dropdown loads users from the selected organization.
3. Select a user.
4. Fill in name, expiration time, and remark.
5. Save, then copy and store secret_key securely.

1.2. Fields

Field	Description
Name	Display name used to identify the key purpose.
Organization	Tenant that owns the key.
User	User identity represented by the key. The user list comes from the selected organization.
Expiration Time	When the credential expires. If empty, platform default policy applies.
Remark	Notes about caller, purpose, or handover.
secret_key	Issued secret. Store and use it only in trusted channels.

1.3. Edit Rules

When editing an existing API Key, organization and user cannot be changed. The platform does not regenerate secret_key during editing.

To change organization or user, delete the old key and create a new one.

1.4. Permission Model

The API Key is signed with the selected user and organization identity. API calls using this key act as that user in that organization.

After an API Key is deleted, the cached credential is also cleared. External systems should stop using deleted or expired keys immediately.

1.5. Recommendations

• Create a separate API Key for each external system.
• Set an explicit expiration time and rotate before it expires.
• Record purpose, owner, and calling system in the remark.
• Do not place secret_key in public documents, frontend code, or logs.