Qdrant API key: create, secure, and rotate yours

Qdrant API key: create, secure, and rotate for production

Your Qdrant API key is the single credential standing between your vector data and the open internet. Treat it like a database password — because that is exactly what it is, even if the database stores embeddings instead of rows.

The direct answer: Qdrant Cloud generates API keys in the cluster dashboard with one click. Self-hosted Qdrant configures keys in config.yaml or via environment variables. Both take under five minutes. The 2023 OWASP API Security Top 10 lists broken authentication as the second risk in that edition.

How does Qdrant API key authentication work?

Every request to Qdrant must include a valid API key. For REST calls, include it as a header: api-key: your-qdrant-api-key. For gRPC, pass the key as metadata. Invalid or missing keys receive a 403 Forbidden response.

How do you create a Qdrant API key?

On Qdrant Cloud: Log into cloud.qdrant.io, select your cluster, open the "API Keys" panel, and click "Create API Key". Choose between full access and read-only. Copy the key immediately — Qdrant displays it once, then hashes it permanently.

On self-hosted Qdrant: Set the key in config.yaml under the service section, or via environment variable QDRANT__SERVICE__API_KEY=your-key.

Best practices for securing Qdrant API keys

• Never hardcode keys. Store in environment variables or a secrets manager. On CodeWords, secrets are injected into your workflow runtime — they never appear in code or logs.
• Use read-only keys for read paths. A leaked read-only key cannot modify or delete collections.
• Restrict network access. Configure IP allowlists on Qdrant Cloud.
• Separate keys per environment. Different keys for dev, staging, and production.

How do you rotate Qdrant API keys without downtime?

1. Generate a new key (old key remains valid). 2. Update all applications (on CodeWords, update the secret in workflow configuration). 3. Verify with health checks. 4. Revoke the old key. For zero-downtime rotation on self-hosted Qdrant, temporarily configure two valid keys during the transition window.

How do you use a Qdrant API key in RAG workflows?

Your key enables two operations: storing embeddings and retrieving context. On CodeWords, a complete RAG workflow uses document ingestion (Firecrawl or file upload), embedding, Qdrant storage, semantic search, and LLM generation. LLM access is included — see CodeWords pricing. CodeWords templates include pre-built RAG patterns.