Authentication

The Fivetran REST API uses API key authentication. If you're getting started, use a Scoped API key — it's tied to your Fivetran user account and inherits your RBAC permissions. For centralized, organization-managed key management, use a System key instead.

Scoped API key

A Scoped API key is a key-secret pair that you create as a Fivetran user to call the Fivetran REST API. The Scoped API key links to your account and inherits your RBAC permissions.

Instructions

In the Fivetran dashboard, click your username.
Click API Key.
Click Generate API key. If an API key already exists, click Generate new API key instead.
Make a note of the key and secret as they disappear once you close the page or navigate away. You need the key and secret to access your Fivetran account using the API.

API secret regeneration

We recommend you regenerate your API secret in the following cases:

The API secret has been exposed or lost
You are cloning or migrating your environment
There was a team or vendor change
It's time for a routine rotation

To generate a new secret, do the following:

In the Fivetran dashboard, click your username.
Click API Key.
Click Generate new API key.
Click Generate new secret. This action instantly replaces your API secret key with a new one.
Regenerating your API secret invalidates the existing key–secret pair. The key remains unchanged, but the old combination stops working. Make sure to update any services that use the old pair to avoid outages.

Scoped API key FAQs

Read answers to frequently asked questions about our scoped API keys.

Expand for details

What happens when I delete a user?

The scoped API key is deleted and cannot be used anymore.

How do I revoke a Fivetran API key?

To revoke a key, delete the user.

How do I rotate a key without taking down my application?

You must have two valid Fivetran API keys. You may need to create another Fivetran user and assign the same RBAC permissions as the user whose key you want to rotate. Once you have two Fivetran API keys with the same permissions, do the following:

In your application, switch from the original key you want to rotate to another user’s key.
In Fivetran, rotate the original key:
1. In your dashboard, click your username.
2. Click API Key.
3. Click Generate API key.
4. Click Generate.
5. Make a note of the new secret and store it in your relevant key management system.
Switch back to using the original key.

Service account API key Private Preview

Service account API keys let you authenticate and interact with the Fivetran REST API programmatically. Each key is associated with a service user and inherits that user’s permissions, limiting the API actions and resources it can access. Service users are intended only for programmatic access and can't sign in to the Fivetran dashboard. Each service user can have only one API key at a time. If the service user already has a key, you must rotate or delete it before generating a new one.

To learn how to generate and manage service account API keys, see our Service Account API Key Management documentation.

System API key

A System key is an organization-managed API key–secret pair for the Fivetran REST API. Use System keys to replace user-oriented, scoped API keys. Instead of relying on RBAC to scope permissions, you set permission at the key level and manage them centrally. This solves for key pain points in securely managing keys, allowing you to understand usage, rotation, and other key information.

See our System Keys documentation for more details.

Use API key in requests

For each request to the API, send the Base64-encoded string api_key:api_secret in the Authorization HTTP header.

Authorization: Basic <base64(api_key:api_secret)>

You can use the -u flag for curl to encode to Base64:

curl -u api_key:api_secret "https://example.com"

Or, you can encode to Base64 by running one of the following commands in CLI (depending on your environment):

On Linux/macOS:

echo -n '<API Key>:<Secret Key>' | base64

On Linux/macOS (using OpenSSL):

echo -n '<API Key>:<Secret Key>' | openssl base64

On Windows (Command Prompt with OpenSSL installed):
```
echo "<API Key>:<Secret Key>" | openssl base64
```

On Windows (PowerShell):

[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("<API Key>:<Secret Key>"))

Example

API key - d9c4511349dd4b86
Secret - 1f6f2d161365888a1943160ccdb8d968
Concatenated string - d9c4511349dd4b86:1f6f2d161365888a1943160ccdb8d968
Base64-encoded string - ZDljNDUxMTM0OWRkNGI4NjoxZjZmMmQxNjEzNjU4ODhhMTk0MzE2MGNjZGI4ZDk2OA==

Authorization HTTP header: Authorization: Basic ZDljNDUxMTM0OWRkNGI4NjoxZjZmMmQxNjEzNjU4ODhhMTk0MzE2MGNjZGI4ZDk2OA==

The API key is unique for the account and Account Administrator user pair. Different Account Administrators have different API keys.