--- name: monitoring-access_key title: Managing access keys description: The **Access Key** is a token that you must use to configure monitoring agents to successfully forward data to your IBM Cloud Monitoring instance in IBM Cloud. last-updated: 2024-06-28 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/monitoring?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Managing access keys {: #access_key} The **Access Key** is a token that you must use to configure monitoring agents to successfully forward data to your IBM Cloud Monitoring instance in IBM Cloud. {: shortdesc} ## Getting the access key through the IBM Cloud UI {: #access_key_ibm_cloud_ui} To get the access key for an IBM Cloud Monitoring instance through the IBM Cloud UI, complete the following steps: 1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login){: external}. 2. Go to the Menu icon ![Menu icon](../../icons/icon_hamburger.svg) > **Observability**. 3. Select **Monitoring**. The IBM Cloud Monitoring dashboard opens. You can see the list of monitoring instances that are available on IBM Cloud. 4. Identify the instance for which you want to get the access key. Click the *Actions* icon ![Actions icon](../../icons/action-menu-icon.svg "Actions") next to the instance and then click **Manage key**. 5. A window opens where you can click **Show key** to view the access key. ## Getting the access key through the CLI {: #access_key_cli} To get the access key for a monitoring instance through the command line, complete the following steps: 1. [Pre-requisite] [Install the IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli&format=markdown). 2. Log in to the region in the IBM Cloud where the monitoring instance is running. Run the following command: [ibmcloud login](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli&format=markdown#ibmcloud_login) 3. Set the resource group where the monitoring instance is running. Run the following command: [ibmcloud target](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_cli&format=markdown#ibmcloud_target) By default, the `default` resource group is set. 4. Get the instance name. Run the following command: [ibmcloud resource service-instances](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource&format=markdown#ibmcloud_resource_service_instances) ```text ibmcloud resource service-instances ``` {: pre} 5. Get the name of the API key that is associated with the monitoring instance. Run the [`ibmcloud resource service-keys`](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource&format=markdown#ibmcloud_resource_service_keys) command: ```text ibmcloud resource service-keys --instance-name INSTANCE_NAME ``` {: pre} where INSTANCE_NAME is the name of the instance that you obtained in the previous step. 6. Get the access key. Run the [ibmcloud resource service-key](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource&format=markdown#ibmcloud_resource_service_key) command: ```text ibmcloud resource service-key APIKEY_NAME ``` {: pre} where APIKEY_NAME is the name of the API key. The output from this command includes the field **Access Key** that contains the access key for the instance. ## Creating additional access keys {: #access_key_create} If the access key is compromised or you have a policy to renew it after a number of days, you can generate a new access key and disable the old one. To create a new access key for an IBM Cloud Monitoring instance, complete the following steps: 1. Obtain the API token from the IBM Cloud Monitoring UI. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-api_monitoring_token&format=markdown). 2. Issue a curl POST request against the monitoring endpoint to generate a new access key. ```text curl -X POST -H 'Authorization: Bearer API_TOKEN' https:ENDPOINT/api/customer/accessKeys ``` {: pre} Where * `ENDPOINT` is the URL for the region where the monitoring instance is available. For more information, see [monitoring endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpoints&format=markdown#endpoints). * `API_TOKEN` is the API token that you get in step 1. The output will provide the newly generated access key in the response. ```json { "customerAccessKey": { "enabled": true, "accessKey": "12345678-1234-1234-1234-123456789012", "dateCreated": 1573852152224, "dateDisabled": null } } ``` {: screen} 3. The access key can now be used in the monitoring agent configuration files. ## Disabling an access key {: #access_key_disable} To disable an existing access key for an IBM Cloud Monitoring instance, complete the following steps: 1. Obtain the API Token from the IBM Cloud Monitoring UI ( [see instructions](https://cloud.ibm.com/docs/monitoring?topic=monitoring-api_monitoring_token&format=markdown) ). 2. Issue a curl POST request against the monitoring endpoint to disable the given access key. ```text curl -X POST -H 'Authorization: Bearer API_TOKEN' https:ENDPOINT/api/customer/accessKeys/ACCESS_KEY/disable ``` {: pre} Where * `ENDPOINT` is the URL for the region where the monitoring instance is available. For more information, see [monitoring endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpoints&format=markdown#endpoints). * `API_TOKEN` is the API Token retrieved in step 1. * `ACCESS_KEY` is the access key that you wish to disable. Once you disable the access key, the agents connected with the access key will be immeditely blocked from sending metrics to this IBM Cloud Monitoring instance. There is no option to delete access keys at this time. {: note} ## Enabling an access key {: #access_key_enable} To enable an existing access key for an IBM Cloud Monitoring instance, complete the following steps: 1. Obtain the API Token from the IBM Cloud Monitoring UI. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-api_monitoring_token&format=markdown). 2. Issue a curl POST request against the monitoring endpoint to enable the given access key. ```text curl -X POST -H 'Authorization: Bearer API_TOKEN' https://ENDPOINT/api/customer/accessKeys/ACCESS_KEY/enable ``` {: pre} Where * `ENDPOINT` is the URL for the region where the monitoring instance is available. For more information, see [monitoring endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpoints&format=markdown#endpoints). * `API_TOKEN` is the API Token retrieved in step 1. * `ACCESS_KEY` is the access key that you wish to enable. After you enable the access key, the agents will need to be manually restarted since an agent that connects with a disabled access key will be terminated. {: note} ## Viewing the available access keys {: #access_key_view} To view all of the access keys for an IBM Cloud Monitoring instance, complete the following steps: 1. Obtain the API Token from the IBM Cloud Monitoring UI. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-api_monitoring_token&format=markdown). 2. Issue a curl GET request against the regional monitoring endpoint to enable the given access key. ```text curl -X GET -H 'Authorization: Bearer API_TOKEN' https://ENDPOINT/api/customer/accessKeys ``` {: pre} Where * `ENDPOINT` is the URL for the region where the monitoring instance is available. For more information, see [monitoring endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpoints&format=markdown#endpoints). * `API_TOKEN` is the API Token retrieved in Step 1. The output will provide a list of the access keys in the response and whether they are enabled. ```json { "customerAccessKeys": [ { "enabled": true, "accessKey": "12345678-1234-1234-1234-123456789012", "dateCreated": 1541096409000, "dateDisabled": null }, { "enabled": false, "accessKey": "87654321-1234-1234-1234-123456789012", "dateCreated": 1573849361000, "dateDisabled": 1573849367000 } ] } ``` {: screen} ## Deleting access keys {: #delete_key} To delete an access keys for an IBM Cloud Monitoring instance, complete the following steps: 1. Obtain the API Token from the IBM Cloud Monitoring UI. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-api_monitoring_token&format=markdown). 2. Issue a curl DELETE request against the regional monitoring endpoint to delete the access key. ```text curl -X DELETE -H 'Authorization: Bearer API_TOKEN' -H "IBMInstanceID: GUID" https://ENDPOINT/api/customer/accessKeys/ACCESS_KEY ``` {: pre} Where * `ENDPOINT` is the URL for the region where the monitoring instance is available. For more information, see [monitoring endpoints](https://cloud.ibm.com/docs/monitoring?topic=monitoring-endpoints&format=markdown#endpoints). * `API_TOKEN` is the API Token retrieved in Step 1. * `GUID` is the GUID of the monitoring instance associated with the access key. See [headers for IAM tokens](https://cloud.ibm.com/docs/monitoring?topic=monitoring-mon-curl&format=markdown#mon-curl-headers-iam). * `ACCESS_KEY` is the access key to be deleted. You can [view a list of all access keys](#access_key_view) to obtain the access key values.