Allowing Users to Create API Keys

The site-wide Allow Users To Create API Keys setting controls whether users can create credentials for their own integrations. This lets Site Administrators keep control of integration credentials while users continue working in the Files.com apps. User keys remain subject to the associated user's permissions and the key's access scope.

By default, only Site Administrators can create these integration keys. Enabling the setting lets other users create their own.

When the setting is disabled, users who are not Site Administrators cannot create API keys for their own integrations. Site Administrators can create or remove API keys for individual users. A user who is not a Site Administrator cannot remove an API key created for them by an administrator.

When the setting is enabled, any user can create an API key for their own account and remove API keys from their own settings.

Whether the setting is enabled or disabled, users who are not Site Administrators cannot view or manage API keys for other users.

The Desktop App and Mobile App automatically receive dedicated API keys when users sign in. These keys serve as long-lived session tokens, keeping the apps connected between uses so users do not have to repeat the sign-in process each time they return to their files. Issuing these tokens is part of app sign-in and cannot be disabled with Allow Users To Create API Keys. Users do not need permission to create integration keys to sign in to either app.

The site's Desktop/Mobile Session Lifetime controls how long these app session tokens remain valid. This separates how often app users must sign in again from whether they can create credentials for integrations.

App session keys appear in the user's API key list returned by GET /user/api_keys, but they are not shown in the web interface's API key list. Their presence in an API response does not mean that the user has been allowed to create integration keys.