API keys let outside systems use Rhythm's API on behalf of your organization. This article explains where to manage API keys and what each setting does. To learn what an API key is and why its secret appears only once, see API Keys for Partner Integrations.
Where to Find It
Go to System & Security › API Keys to open Manage API Keys. The page lists every key issued for your account by name and type, but it never shows the secret. From this page, you can create, edit, clone, delete, or rotate a key's secret.
Tip
To find the identifier an existing key uses with its identity provider, hover over the hashtag icon on that key's row. This is the same client ID a vendor needs in its OAuth client configuration.
Some Auth0 applications count toward your account's application limit but are not created from this page, so they may not appear in this list. If your identity provider shows more applications than you see here, contact Support before assuming you can create more.
The Settings
| Setting | Options | Default | Effect |
|---|---|---|---|
| Name | Free text; required | — | Identifies the key in the list and in the one-time link panel. |
| Description | Free text; optional | — | Adds notes about what the key is for. |
| Key type | Non-Interactive or Web SSO | Non-Interactive | Use Non-Interactive for back-end, server-to-server integrations. Use Web SSO for a web application that signs your members in through single sign-on; this option shows the address-list settings below. |
| Callback URLs | One or more addresses; shown for a Web SSO key | — | Defines where the identity provider can send a signed-in person back. Each address must match the redirect URI the integration uses, character for character, including its path. |
| Allowed Logout URLs | One or more addresses; shown for a Web SSO key | — | Defines where the identity provider can send a person after signing out. |
| Allowed Origins, Web Origins, Allowed Clients | One or more values; optional, shown for a Web SSO key | — | Adds the other addresses and client identifiers the SSO configuration accepts. |
Creating or editing a key does not show or ask for its secret. When you create a key successfully, Rhythm replaces the form with a one-time link panel that shows the key's client identifier and a single-use link to its secret. See API Keys for Partner Integrations for how that disclosure works. When you save changes to an existing key's name, description, or address lists, Rhythm does not create a new secret or link. Only creating a key or rotating its secret does that.
Warning
Callback URLs and Allowed Logout URLs must match exactly what the application sends, including any query string. If sign-in fails with a callback URL mismatch, or logout does not redirect where you expect, the application is usually using an address that does not match what you entered here. Adding an address to Allowed Logout URLs only allows the application to request that redirect; it does not create a redirect by itself, and nothing happens if the application never asks for one. If a partner's platform, such as a content management system, gives you callback or logout URLs, add those addresses here. If it asks for settings this screen does not show, contact Rhythm to review the configuration with you.
Choosing a Key Type and Authentication Flow
Before you request credentials from Rhythm or a third-party vendor, decide whether the integration signs in a person or only pulls API data on its own. That choice determines the key type: choose Non-Interactive for a script or back-end service that never shows a sign-in screen, and choose Web SSO for anything a person signs into.
If a person will sign in, decide which OAuth flow the integration should use, then create the matching key in Rhythm. A single-page or mobile application that cannot securely store a client secret should use Authorization Code Flow with PKCE. A regular server-side application that can store a secret uses the standard Authorization Code Flow. Whichever flow you choose, use it with the key type you configured here, not a mix of the two.
Some integrations also need Rhythm to grant the key API access on the back end. For example, Auth0 may report that the client is not authorized to call the Rhythm API and needs a client grant. If you see that error after creating the key correctly, contact Support so they can review and enable the access the key needs. You cannot configure that access from this page.
A Non-Interactive key gives you a client identifier and, through the one-time link, a secret. You use that pair to obtain a machine access token for the Rhythm API. A Web SSO key also needs its callback and logout URLs configured before a developer can test sign-in, because the token exchange and address lists are both part of preparing the same application for use.
If your integration needs security profile information in the user payload it receives, include the securityProfiles scope in the authorization request. Without that scope, the token-backed payload does not include that information.
Values a Third-Party Vendor May Ask For
Setting up an OAuth or SSO integration with an outside vendor often means giving them a few identity values beyond the key itself:
- An identifier for your organization: some vendors use their own name for this value; it is typically your organization's domain.
- Auth0 domain and audience: values specific to your Auth0 configuration.
Ask Support if a vendor requests these values and you are not sure what to send.
Warning
Changing this organization identifier in Auth0 after integrations already use it is not a routine configuration change. Rhythm has found that changing it is high-risk and high-effort: it breaks every existing integration immediately and requires every user to sign up again from scratch. Avoid changing it once anything depends on it, and talk to Support first if you believe you need to.
Auth0 Application Limits
Your account's Auth0 plan includes a maximum of 10 applications in total. Rhythm's own Console and Portal access use two of them, which leaves 8 for the applications you create as API keys. When you reach that limit, you cannot create additional keys, and there is no way to raise it.
Tip
If you reach the limit, look for an existing application you no longer need, such as one created for a test or discontinued integration. Reuse or remove it instead of assuming you can always create a new one.
Create or Edit an API Key
You can usually create and configure an API key yourself from this page; Rhythm does not need to do it for you. Read the prerequisites carefully, because an incorrectly configured Web SSO application often causes setup problems that are hard to diagnose later.
Prerequisites
- Console access to reach System & Security › API Keys.
- Know whether the key is for a back-end integration or a web SSO application. For SSO, have the callback and logout addresses the identity provider needs. Decide this, including whether the integration needs end-user login or only API access, before you ask Rhythm or a vendor for application credentials, because it changes what you request.
- For a login-based integration, ask the vendor for all three Auth0-style values it needs: Allowed Callback URLs, Allowed Logout URLs, and Allowed Web Origins. Add every staging and local address separately; Auth0 does not infer one site's addresses from another, and it checks the callback URL's exact path, not just its domain.
- Have a secure way to send the one-time secret link to the developer who needs it, since Rhythm shows it only once.
- For a web SSO key that a Portal application will use, your Portal must already be provisioned. Testing SSO sign-in against a Portal that has not been provisioned yet fails even when the key's settings are correct. If that happens, confirm provisioning is complete before troubleshooting further, and include the configured redirect address when you ask Rhythm to check a failing SSO test.
- Go to System & Security › API Keys and select Create API Key, or select the Edit icon on an existing key's row to change it.
- Enter a name and, optionally, a description.
- Choose Non-Interactive or Web SSO. For Web SSO, enter the callback and logout addresses, plus any origin or client values your integration needs.
- Select Save Changes.
For a web SSO key, sign-in also depends on the Authorization Code grant type being turned on for the key. If an integration says the authorization code grant is not allowed, ask Rhythm to confirm this setting on your key instead of assuming the callback and logout addresses are the problem.
Result
For a new key, Rhythm replaces the form with a panel headed Your API Key Has Been Created. The panel shows the key's client identifier and a Copy Link button for the one-time secret link. Copy the link before you leave the panel. After you select Copy Link, Back to API Keys becomes available. When you save an edit instead, Rhythm returns you to the key list.
Warning
If the copy fails, Rhythm tells you and keeps the values visible so you can select and copy them manually. The exit button is still available after a failed copy, so do not leave the panel until you confirm the link is on your clipboard or otherwise saved.
Tip
Saving Callback URLs here is intended to update the related identity-provider application, so you should not need to make the same change directly with your identity provider. If self-service saving does not seem to take effect, contact Support so they can add the addresses for you.
Some administrators have reopened a Web SSO key after saving new callback addresses and seen an empty Callback URLs list, even though the addresses were still saved and still in effect. If that happens to you, check with Support before re-entering the addresses so you do not create duplicates.
For a web application, make sure the redirect URI is listed as an allowed callback URL. If the integration calls for it, make sure the same domain also appears in the allowed origins. A missing or mismatched value in either place commonly causes an error when the application requests its authorization code. Match each callback URL to the exact site that will use it: your live site, staging site, and local development address each need their own entries, because a URL registered for one site is not automatically available to another.
While you are integrating and before your final URLs are ready, you can use temporary values for testing. A standard Postman OAuth callback URL is commonly used to test an API client's authorization flow before you have a permanent web address to register.
Warning
The address lists on a Web SSO key expect valid, externally reachable URLs. A localhost address for the callback URL, logout URL, or origins is not reachable from the identity provider and can cause the save to fail. When that happens, Rhythm may show only a generic error instead of naming the invalid field, so if a save fails without explanation, check your address lists for a local or otherwise unreachable URL first.
Delete an API Key
Select the Delete icon on the key's row in Manage API Keys, then confirm. Deleting a key takes effect immediately. Any partner system that still presents that key is refused from that moment, with no grace period, and the key no longer appears in your list.
Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| Saving a key in a sandbox fails with "Unable to save API Key" or a message about being unable to locate settings for your account | The sandbox does not yet have its own identity configuration set up. This is more likely right after a sandbox is created or refreshed | Contact Support and ask them to set up identity configuration for the sandbox. You cannot configure this yourself. |
| The API Keys page shows an error saying the service is not enabled for your account, and you cannot view or manage keys at all | Some accounts do not have the API key service enabled | Contact Support to have it enabled. There is no self-service way to turn it on. |
| Creating a new key fails and you are already near or at 10 total applications with your identity provider | You have reached the Auth0 application limit described above | Reuse or remove an application you no longer need, or contact Support if you believe the count is wrong. |
| Saving a Web SSO key's address lists fails with a generic error such as "0 Unknown Error" | One of the addresses is not a valid, externally reachable URL, commonly a localhost value used for local testing | Replace the address with a live or tunnel URL, or use it only temporarily and switch to a permanent one before going live. |