API key creation

Pulsar API keys are application credentials. Each key is limited to one tenant, one ready cluster, one managed namespace, and the selected produce or consume operations.

Before you create a key

You need api-keys:create for the tenant. The selected cluster must belong to that tenant and have status ready, and the namespace must belong to the selected tenant and cluster with status managed.

Use a separate key for each application and environment. This makes rotation and incident response independent.

Create the key

Open Access and RBAC → Pulsar API keys.
Select the tenant.
Select a managed namespace and its cluster.
Enter a recognizable key name, such as orders-production-consumer.
Choose a Valid through date. It must be in the future and no more than one year away.
Select at least one Pulsar permission:
- produce publishes records.
- consume subscribes to and reads records.
Select Generate Pulsar API key.

SQIP grants the generated Pulsar role only the selected namespace operations. It returns the JWT, public TLS service URL, expiry, and—when needed—the private CA path.

Warning

Copy the JWT before closing the one-time credential dialog. SQIP stores a hash and metadata, not the recoverable token, so the secret cannot be displayed again.

The issued-key list shows safe metadata: name, fingerprint prefix, cluster, namespace, operations, endpoint, and expiry.

Configure a client

Use the disclosed value as the Pulsar token and the displayed pulsar+ssl:// service URL as the broker endpoint. Configure the displayed trust certificate path only when your deployment uses a private certificate authority; clients connecting through a public CA do not need an extra certificate.

If the disclosure says Dry run, the value verifies the local control-plane flow only. It is deliberately not a usable JWT and its endpoint is not publicly reachable.

Rotate a key

Create a new key with the same minimum namespace operations.
Store it in the approved secret manager.
Update the application and verify a new connection.
Revoke the old key.

SQIP does not update an issued secret in place. Overlap the old and new keys only for the time needed to verify the rollout.

Revoke or expire a key

Users with api-keys:revoke can select Revoke and confirm. Revocation removes the Pulsar namespace grant and marks the key revoked. The action is idempotent if the key is already revoked.

At expiry, the JWT rejects new authenticated connections. SQIP's expiry worker also removes the namespace grant so already-authenticated or legacy clients cannot retain authorization.

Review pulsar_api_key.created and pulsar_api_key.revoked in Audit Logs. Revocation is not reversible; issue a replacement key when access is needed again.