Academy
5. Creating and Securing API Keys
Learn to create, restrict by IP and revoke API keys so external tools can call OUPI safely on your behalf.
API keys let external tools — scripts, automations, third-party apps — call OUPI on your behalf without you logging in each time. Think of an API key as a special password that represents you: anything it does counts as your action. That's why keeping it secret is essential. You create and manage API keys from your Settings page, the same place you handle the rest of your account security.
To create a new API key, go to Settings. Once generated, the key is shown only once — copy it immediately and store it somewhere safe (a password manager, for example). If you lose it, you'll need to revoke the old key and create a new one. Never paste an API key into a public repository, a shared document, or a chat message.
When possible, restrict each API key to the specific IP addresses that will actually use it. This means even if someone steals the key, they can't use it from an unauthorized location. You configure IP restrictions at creation time in Settings. If your tool runs from a known server or office network, add those IPs right away.
AstuceRevoke any API key you no longer use. An old, forgotten key still grants real access to your account. A quick cleanup in Settings every few weeks keeps your account safe.
AstucePair API keys with two-factor authentication on your account. Even if someone obtains a key, 2FA protects your Settings page so they can't create more keys or change your security options.
À vous de jouerOpen Settings now. Create a test API key, copy it, then try adding an IP restriction. When you're done experimenting, revoke the test key so it can't be used. This full cycle — create, restrict, revoke — is exactly what you'll do in real use.Suivre ce cours dans OUPI → Cet exercice se fait dans la plateforme OUPI.
À retenirAPI keys let external tools act as you in OUPI. Always keep them secret, restrict them by IP address when you can, and revoke any key you no longer need. Combine this with two-factor authentication for the strongest protection. You manage everything from your Settings page — create, restrict, and revoke all in one place.