Scoped API keys and a redesigned API keys page in Console

Snowplow Console API keys are now scoped. When you create a key, you choose the permission level it receives for each Console feature, such as environments, tracking plans, or data structures. Previously, every API key had admin privileges across the whole organization.

Key creation follows these rules:

• When creating a key, you can only grant it permissions that you yourself hold
• A key can never manage other API keys
• Your key's permissions are fixed at creation and do not change when your own permissions change

The API keys page, under Settings > Manage organization > View and manage API keys, has also been redesigned. Snowplow API keys and Iglu Server keys, previously called utility keys, now appear in one table with a Scope column that shows whether a key has read-only access, write access, or legacy global admin access. From the same page you can:

• Search keys by name or key ID
• Filter by key type and sort by any column
• View the exact permissions a key holds
• Clone a key to rotate it without having to re-select the same permissions again
• Copy the Iglu resolver URLs for both environments from the ... menu

Existing API keys keep working as before. They appear as Global admin in the Scope column and cannot be cloned. Replace them with scoped keys, granting only what each integration needs.

See Account management for how to create and manage keys.