Limit an API key to selected protocol surfaces

Protocol restrictions stop one secret from being reused at every supported gateway. Select only the surface used by the client.

Before you start

• Use a disposable workspace and non-confidential test file.
• Choose the smallest permissions and surfaces the task requires.
• Prepare a password manager or secret store; never place a real key in a screenshot, URL or repository.
• Plan to revoke the test key after verification.

Steps: limit an api key to selected protocol surfaces

1. Open the key creation flow and configure permission and location.
2. Under protocol restrictions, choose selected protocols.
3. Enable only the client surface required.
4. Create and store the secret.
5. Authenticate through the allowed surface.
6. Try the same key on an unselected surface and confirm rejection.

Expected result

The test key performs its allowed operation, rejects an operation outside its boundary, and can be identified and revoked without changing the account password.

Limits and important details

• Compatibility clients may require a particular surface even when they use familiar credentials.
• Selecting a protocol does not grant write permission by itself.
• Create separate keys for unrelated clients so each can be revoked independently.

Troubleshooting

The request returns unauthorized. Check the complete secret, API endpoint and whether the key was revoked.

The request returns forbidden. Compare the operation with the key permission, protocol surface, workspace and folder anchor.

A secret was exposed. Revoke it immediately, create a replacement with least privilege and remove the exposed value from logs and history.

Related guides

• Create and manage an API key
• Connect with WebDAV
• Use rclone