Connector keys (the page heading was API keys; this section keeps that name) requires an organisation admin or site manager of the selected organisation. Viewers see a message that says so. A key is created for one site and can also be shared with other sites. The list has one row for each site a key connects. Filter by site and key status to find it. The list shows metadata; it cannot reveal an existing secret.
Add a key
- Select Add API key.
- Select the site.
- Choose Create a new key for this site (recommended) or Use an existing key.
- For a new key, optionally name it, create it, then copy and store the secret before closing the dialog. For an existing key, choose it from Existing key and select Use this key.
- Put the key into that site's Connector, run Test connection, and verify a submission.
The full key of a new key is shown only once. If copying fails, use the selectable value while the dialog is still open. Do not put the key in a report, email, screenshot, or source repository. The dialog shows the site name and Site UUID, not a Sentinel address or Site URL (Connector 1.4.0 and later need neither), and links to the connection guide, "Use the Sentinel Connector on several environments" (this guide while the knowledge base is off).
Share an existing key
Use an existing key lists active keys already connecting a site in an organisation where you manage keys, including another organisation. Expired keys, revoked keys, keys that need rotation and keys whose sites are all inactive or unavailable are not listed. If the list says No existing keys available, create a new key instead. Sentinel cannot show an existing key again, so paste the key you already hold into the new site's Connector.
For best security, we recommend a separate key for each site. If a shared key leaks, every site using it is exposed, and rotating it means updating every one of those sites at once. Sharing a key is your choice. A shared key shows Shared and the number of sites that use it.
Rename a key
Select Rename on a key's row, enter the new name (up to 100 characters) and select Save name. Only the label changes: the key itself keeps working and the Connector does not need updating. Use this to label keys created from a site's Setup tab or by Rotate, which get a default name. A shared key has one name, shown on every site that uses it, so only an organisation admin or site manager of every organisation that uses the key can rename it; otherwise Rename is not shown. Revoked keys cannot be renamed.
Rotate or revoke a key
Rotate replaces a key and stops the old key from working. Save the replacement and update the Connector promptly. For a shared key, rotation replaces the key on every site that uses it, so each of those Connectors needs the new key. Only an organisation admin or site manager of every organisation that uses the key can rotate it; otherwise Rotate is not shown.
Revoke stops the selected key from working for the selected site without creating a replacement. Other sites sharing the key keep working. The key stops working everywhere once no site uses it. Read and confirm the dialog before either action. A Connector that still uses a revoked key cannot submit data.
If you lost the secret, rotate it or create an authorised replacement. A successful key change is not a successful Drupal sync; check Connection and Logs afterwards.
Sentinel staff may also revoke or rotate a key for your organisation, for example after a leak. Every organisation administrator then receives a security email naming the key, its site and whether the old key stopped at once or keeps working until a stated time. If a key was rotated, Sentinel staff send you the new key through a secure channel; put it into the Drupal Sentinel Connector settings before that time, or create your own replacement. A revoked key stops working at once, so create a new key in Connector keys and update the Connector. If the change is unexpected, contact your Sentinel contact.