How to Create and Rotate Authentication Keys in OnePlan

Direct Answer: How to Create and Rotate Authentication Keys in OnePlan

To create an authentication key in OnePlan, go to Configuration > Integrations, select Add Key in the Authentication Keys section, and enter a Key Name and an Expiration date of up to 3 years from today. Select the Global Scopes (OData, Backup) and the Data Type permissions (Read, Create, Update, Delete) the key needs, then select ADD. Copy the key and store it securely, because it cannot be recovered after you leave the page. To rotate a key, create a replacement key, update the tool that uses it, and delete the old key.

What This Article Covers: Authentication Key Creation and Rotation

This article explains how to create authentication keys in OnePlan, how to choose an expiration date and scopes for each key, and how to replace or remove keys.

What you will accomplish By the end of this article, you will be able to create an authentication key with an expiration date and only the permissions it needs, and rotate or delete keys when they expire or are no longer used.

Before You Begin: Creating an Authentication Key

Before you begin, make sure you have:

• A OnePlan account with administrator access to Configuration
• Access to Configuration > Integrations
• The name of the integration, report, or backup that will use the key
• The list of Global Scopes and Data Type permissions the key needs. See the setup article for your integration for its required permissions.
• A secure location, such as a password manager, to store the key after it is created

Why This Matters: Authentication Key Expiration and Scopes

Context: What Authentication Keys Do in OnePlan

Authentication keys let external tools connect to OnePlan without a user sign-in. Common uses include OData reporting, backups, and integrations built with connectors such as OneConnect, Power Automate, and the OnePlan API. Each key has a name, an expiration date, and a set of scopes.

Context: Expiration Dates and Scopes

An expiration date limits how long a key works, which supports regular key rotation. Scopes limit what a key can access. Global Scopes allow a key to use the OData reporting feed or the Backup utility. Data Type permissions control API access to Configuration, Plans, Workplan, Resources, Resource Plans, Financials, Comments, and Integrations, with separate Read, Create, Update, and Delete permissions for each. A key with only the permissions it needs limits the data an external tool can reach if the key is ever exposed.

Context: Keys Created Before Expiration and Scopes

Authentication keys created before expiration dates and scopes were introduced are set to never expire and include all scopes, so existing integrations continue to work without changes. Replace these keys with scoped keys that have expiration dates as part of regular key rotation.

Step-by-Step: Creating and Rotating Authentication Keys in OnePlan

Task: Create an Authentication Key

Starting from OnePlan:

1. Go to Configuration > Integrations.
2. In the Authentication Keys section, select Add Key. The Add Key form opens.
3. In the Key Name field, enter a name that identifies what the key is used for (for example, Power BI Reporting).
4. In the Expiration field, enter the date the key stops working in mm/dd/yyyy format. The date cannot be more than 3 years from today.
5. Under Global Scopes, select the scopes the key needs: - OData — Allows the key to access the reporting OData feed. - Backup — Allows the key to be used for backups.
6. In the Data Type table, select the permissions the key needs for each data type. Select All to grant every permission for a data type. - Read — View data of that type. - Create — Add new data of that type. - Update — Change existing data of that type. - Delete — Remove data of that type.

Note: Selecting Update or Delete also selects Read.

7. Select ADD.

8. Copy the new key from the Authentication Keys list and store it in a secure location. The key is encrypted when you reload the page and cannot be recovered. If you lose a key, create a new one.

Note: The Authentication Keys list shows each key’s Key Name and Expiration date. Keys without an expiration date show Never. The key value is not displayed after you leave the page.

### Task: Rotate an Authentication Key

Starting from Configuration > Integrations:

1. Create a new key with the same scopes and permissions as the key you are replacing, and set a new expiration date. See Task: Create an Authentication Key.
2. Update the integration, report, or backup to use the new key.
3. Confirm the integration, report, or backup connects successfully with the new key.
4. In the Authentication Keys list, select Delete next to the old key.

Task: Delete an Authentication Key

Starting from Configuration > Integrations:

1. In the Authentication Keys list, find the key you want to remove.
2. Select 🗑️ Delete next to the key.

Note: Any integration, report, or backup that uses a deleted key can no longer connect to OnePlan.

Frequently Asked Questions: Authentication Keys in OnePlan

Q: How do I create an authentication key in OnePlan? A: In OnePlan, go to Configuration > Integrations, select Add Key, and enter a Key Name and Expiration date. Choose the Global Scopes and Data Type permissions the key needs, select ADD, and then copy and store the key.

Q: Can I view an authentication key after I create it in OnePlan? A: No. In OnePlan, the key is displayed when it is created and is encrypted when you reload the page. The Authentication Keys list shows only the key name. If a key is lost, create a new key and update the tool that uses it.

Q: How long can an authentication key last in OnePlan? A: In OnePlan, you set an Expiration date when you create a key, and the date cannot be more than 3 years from today. Keys created before expiration dates were introduced are set to never expire.

Q: What happens to my existing authentication keys in OnePlan? A: In OnePlan, existing keys are set to never expire and include all scopes, so current integrations continue to work without changes. To follow key rotation practices, replace them with scoped keys that have expiration dates.

Q: How do I rotate an authentication key in OnePlan? A: In OnePlan, create a new key with the same permissions and a new expiration date, update the integration or report to use the new key, and then select Delete next to the old key in the Authentication Keys list.

Q: What permissions does an authentication key need for an integration in OnePlan? A: In OnePlan, the required Global Scopes and Data Type permissions depend on the integration. Select only the permissions the integration needs. See the setup article for your integration for its required permissions.

What to Do Next: Authentication Keys

Get started with related tasks:

• Set Up OnePlan OData Reporting
• Schedule OnePlan Backup Utility Backups
• Manage Integration Tools

Learn about related topics:

• Integrations Settings in OnePlan - Overview
• OnePlan Configuration Integration Page
• Review Integration Logs
• Access the OnePlan API Documentation