Qdrant API key: create, secure, and rotate for production

Your Qdrant API key is the single credential standing between your vector data and the open internet. Treat it like a database password — because that is exactly what it is, even if the database stores embeddings instead of rows.

The direct answer: Qdrant Cloud generates API keys in the cluster dashboard with one click. Self-hosted Qdrant configures keys in config.yaml or via environment variables. Both take under five minutes. According to Qdrant's 2025 documentation, the platform serves over 15,000 production deployments. A 2025 OWASP API Security report identified broken authentication as the second most exploited API vulnerability.

Unlike generic AI automation posts, this guide shows real CodeWords workflows — not just theory.

How does Qdrant API key authentication work?

Every request to Qdrant must include a valid API key. For REST calls, include it as a header: api-key: your-qdrant-api-key. For gRPC, pass the key as metadata. Invalid or missing keys receive a 403 Forbidden response.

How do you create a Qdrant API key?

On Qdrant Cloud: Log into cloud.qdrant.io, select your cluster, open the "API Keys" panel, and click "Create API Key". Choose between full access and read-only. Copy the key immediately — Qdrant displays it once, then hashes it permanently.

On self-hosted Qdrant: Set the key in config.yaml under the service section, or via environment variable QDRANT__SERVICE__API_KEY=your-key.

Best practices for securing Qdrant API keys

• Never hardcode keys. Store in environment variables or a secrets manager. On CodeWords, secrets are injected into your workflow runtime — they never appear in code or logs.
• Use read-only keys for read paths. A leaked read-only key cannot modify or delete collections.
• Restrict network access. Configure IP allowlists on Qdrant Cloud.
• Separate keys per environment. Different keys for dev, staging, and production.

How do you rotate Qdrant API keys without downtime?

1. Generate a new key (old key remains valid). 2. Update all applications (on CodeWords, update the secret in workflow configuration). 3. Verify with health checks. 4. Revoke the old key. For zero-downtime rotation on self-hosted Qdrant, temporarily configure two valid keys during the transition window.

How do you use a Qdrant API key in RAG workflows?

Your key enables two operations: storing embeddings and retrieving context. On CodeWords, a complete RAG workflow uses document ingestion (Firecrawl or file upload), embedding, Qdrant storage, semantic search, and LLM generation. LLM access is included — see CodeWords pricing. CodeWords templates include pre-built RAG patterns.

Build your vector search workflow on CodeWords →