---
title: "Authentication"
description: "Authenticate CertCentral Services API requests with API keys and manage key permissions."
source_url: https://dev.digicert.com/certcentral-apis/authentication.html
---

DigiCert CertCentral® APIs use API keys for both authentication and authorization. Authenticating to the service should be relatively straightforward if you've ever worked with header-based authentication before.

## Header-based authentication

Each request to the service must include an API key. This is done using the custom HTTP header `X‑DC‑DEVKEY`. Here's a simple API request to the Services API [List users](https://dev.digicert.com/md/certcentral-apis/services-api/users/list-users.md) endpoint using cURL.


> **Info**
>
> Be sure to replace `{{api_key}}` with your actual API key.


```bash
curl -X GET \
  'https://www.digicert.com/services/v2/user' \
  -H 'Content-Type: application/xml' \
  -H 'X-DC-DEVKEY: {{api_key}}'
```

## Generate an API key

When generating API keys, you can generate one or more API keys for an individual in CertCentral or for a service user.


> **Warning**
>
> After you generate a key, we display it only once. There is no way to retrieve a lost API key. If you lose a key, you should revoke it and generate a new one.


1. To generate a new key, <a href="https://www.digicert.com/account/login.php" target="_blank" rel="noopener noreferrer">sign in</a> to CertCentral.
   API keys are generated and managed in your CertCentral account.
2. In CertCentral, in the left menu, go to **Automation** **>** **API Keys**.
3. On the **API Keys** page, select **Add API Key**.
4. In the **Add API Key** window, enter a **Description** for the API key and select **Add** (for example, enter the name of the app or user you are linking the key to).
   Repeat this process for each API key you want to generate, enter a description, and select **Add**—you can create a maximum of 30 API keys per session.
5. In the **User** menu, do one of the following:
   1. **Link the API key to a CertCentral user**
      In the **User** menu, select the user you want to link the key to.
      When linking a key to a user, you link the user's permissions to the key. By default, the key is authorized to perform any actions the user can.
   2. **Link the API key to a service user**
      A service user has API-only access to your CertCentral account.
      **Link the API key to an existing service user**
      In the **User** menu, select the service user you want to link the key to.
      **Create a service user to link the API key to**
      Only administrators can create service users. When creating a service user, you link the administrator's permissions to the key. By default, the service user is authorized to perform any actions the administrator can.
      Service user creation is tracked in your CertCentral audit logs: Date & Time, User, Activity, Source, IP Address, Division, and Country.
      1. In the **User** menu, select **Create new service user**.
      2. **Email address**
         Add the email address you want to link to this service user. Some of our processes require the user associated with the API key to have an email address.
      3. **Division restrictions (optional)**
         Select the divisions to which you want to restrict the service user. This option only appears if you are using divisions in your CertCentral account.
         If you leave this field empty, the service user has the same division access as the administrator creating the service user.
6. **API key restrictions (optional)**
   You can restrict the API key's permissions to a specified set of actions. In the menu, select one of these options:
   - **Orders**
     Limits key to these actions: [Orders](https://dev.digicert.com/md/certcentral-apis/services-api/orders.md), [Requests](https://dev.digicert.com/md/certcentral-apis/services-api/requests.md), and [Certificates](https://dev.digicert.com/md/certcentral-apis/services-api/certificates.md).
   - **Orders, Domains, Organizations**
     Limits key to these actions: [Orders](https://dev.digicert.com/md/certcentral-apis/services-api/orders.md), [Requests](https://dev.digicert.com/md/certcentral-apis/services-api/requests.md), [Certificates](https://dev.digicert.com/md/certcentral-apis/services-api/certificates.md), [Organizations](https://dev.digicert.com/md/certcentral-apis/services-api/organizations.md), and [Domains](https://dev.digicert.com/md/certcentral-apis/services-api/domains.md).
   - **View Only**
     Limits key to GET requests only. POST, PUT, or DELETE requests are disabled.
   - **User Management**
     Limits key to these actions: [Users](https://dev.digicert.com/md/certcentral-apis/services-api/users.md).
7. Select **Add API Key**.
8. In the **New API Key** window, select the generated key to copy, or if you created multiple API keys, select **Download CSV** to get a CSV file containing all the API keys.
9. Save the API key (or keys) in a secure location.
   **Note**: API keys are only displayed one time.
10. After saving the API key (or keys), select **I understand I will not see this again**.

### What's next

You're ready to use DigiCert CertCentral APIs. Your new API key (or keys) is added to the list of keys on the **API Keys** page. Return to this page to track or revoke API keys.

## Edit an API key

As needed, you can edit an API key to update the description or to modify the key's permissions.

1. In your CertCentral account, in the left main menu, go to **Automation** **>** **API Keys**.
2. On the **API Keys** page, select the **API Key Name** link.
3. In the **Update API Key** window, modify the **Description** or update the API Key permissions.
4. To remove API key restrictions, in the **API key restrictions (optional)** field, select the **X** at the end of the entry. The field will now read **None**.
5. To update the API key's permissions, in the **API key restrictions (optional)** menu, select one of these options:
   - **Orders**
     Limits key to these actions: [Orders](https://dev.digicert.com/md/certcentral-apis/services-api/orders.md), [Requests](https://dev.digicert.com/md/certcentral-apis/services-api/requests.md), and [Certificates](https://dev.digicert.com/md/certcentral-apis/services-api/certificates.md).
   - **Orders, Domains, Organizations**
     Limits key to these actions: [Orders](https://dev.digicert.com/md/certcentral-apis/services-api/orders.md), [Requests](https://dev.digicert.com/md/certcentral-apis/services-api/requests.md), [Certificates](https://dev.digicert.com/md/certcentral-apis/services-api/certificates.md), [Organizations](https://dev.digicert.com/md/certcentral-apis/services-api/organizations.md), and [Domains](https://dev.digicert.com/md/certcentral-apis/services-api/domains.md).
   - **View Only**
     Limits key to GET requests only. POST, PUT, or DELETE requests are disabled.
   - **User Management**
     Limits key to these actions: [Users](https://dev.digicert.com/md/certcentral-apis/services-api/users.md).
   
> **Warning**
>
> When adding permission restrictions to an active API key, you’ll break any integrations using that key if expanded permissions are required. To fix these broken integrations, you’ll need to edit the key and remove the restrictions.

6. When ready, select **Update API Key**.

## Edit a service user

As needed, you can edit a service user and update the email address and division restrictions.

1. In your CertCentral account, in the left main menu, go to **Account > Service Users**.
2. On the **Services Users** page, select the service user you want to update.
3. On the Service User's details page, update the following information as needed:
   1. **Email address**
      Update the email address you want to link to this service user. Some of our processes require an email address.
   2. **Division restrictions**
      Update the divisions to which you want to restrict the service user. This option only appears if you are using divisions in your CertCentral account.
   
> **Warning**
>
> Removing division access affects the service user's active API key. If division permissions are required, any integrations using that key will be broken. To fix these broken integrations, you'll need to edit the service user and restore the division access.

4. When ready, select **Update user**.


## Troubleshoot API key errors

<table><tr><td>

If Azure Key Vault reports that your CertCentral API key is invalid, verify that the API key is active, has the required permissions, and is associated with a user or service user that has access to the appropriate division. To do so:

1. Verify that the API key is active.<br>
   Inactive or revoked API keys cannot be used to authenticate API requests.

   i. Sign in to CertCentral.  
   ii. In the left menu, go to **Automation > API Keys**.  
   iii. Locate the API key.  
   iv. Check the **Status** column.  
   v. If the API key is inactive, activate it.  

> **Info**
>
> If the API key has been revoked, it cannot be reactivated. Generate a new API key and update your Azure Key Vault configuration with the new key. API keys are displayed only once when they are created, so be sure to store them securely.


2. Verify API key permissions.<br>
   An API key inherits the permissions of the user or service user it is linked to. API key restrictions can further limit what the key is allowed to do.

   i. In CertCentral, go to **Automation > API Keys**.  
   ii. Select the API key.  
   iii. Review the **API key restrictions**.  
   iv. If the API key is restricted to **View Only** or **User Management**, it cannot be used to request certificates.  
   v. Remove unnecessary restrictions.  
   vi. Select **Update API Key**.  

3. Verify service user division access.<br>
   If the API key is linked to a service user, ensure that the service user has access to the appropriate division.

   i. In CertCentral, go to **Account > Service Users**.  
   ii. Select the service user associated with the API key.  
   iii. In the **User Access** section, verify that the service user has access to the correct division.  
   iv. Update the service user if necessary.  

> **Info**
>
> Division restrictions apply only when divisions are enabled for your CertCentral account. For more information on Divisions, see <a href="https://docs.digicert.com/en/certcentral/get-started/onboard-an-organization-in-certcentral/configure-divisions-for-enterprise-accounts.html" target="_blank" rel="noopener noreferrer">Configure divisions for Enterprise accounts</a>.

</td></tr></table>