Introduction
Starting with Artifactory 7.98, JFrog has officially disabled the creation of new API keys by default to encourage the transition to more secure Identity Tokens. However, users upgrading from older versions may still see the "API Key" section in their user profile. This article explains the technical logic behind this UI behavior and how to confirm that your security policies are active.
Description
Administrators may observe that even after upgrading to a version where API keys are deprecated (7.98+) or manually setting 'disable-api-key-creation: true', the "API Key" field persists in the Edit Profile screen.
Observed Symptoms
-
Existing users still see an API Key field.
-
The "Generate" button might still appear to be active for some accounts.
-
New users created after the upgrade do not see the API Key section.
-
The ‘disable-api-key-creation’ parameter might not be visible in the ‘values.yaml’ or ‘access.config.latest.yml’ even if the restriction is functioning.
For example:
Root Cause and UI Logic
The visibility of the API Key section is governed by a "Legacy Presence" rule:
1. Existing Keys: If a user has a pre-existing API key stored in the database, Artifactory displays the section so the user can view or revoke the credential. It does not automatically hide active keys to avoid breaking existing integrations.
2. Creation Blocked: The configuration parameter 'disable-api-key-creation' specifically blocks the backend's ability to generate new strings. It does not retroactively hide the UI for users who already have a key.
Verification:
We can verify the true state of the system using the following methods:
Browser Inspector (HAR/Network Verification)
This is the most accurate way to confirm if the setting is active:
1. Open your browser's Developer Tools (F12) and go to the Network tab.
2. Navigate to your User Profile page and enter the password.
3. Filter for a request named: 'api_key' (as shown in the image earlier)
4. In the Response body, verify that the following parameter is set to false:
"block_create_api_key": true
Test with New User
-
Create a new test user account.
-
Log in as that user and check the profile.
-
Expected Result: The API Key section will be completely hidden because there is no legacy key to display, and new creation is forbidden.
Solution
If you want to remove the API Key UI for an existing user completely, the existing key must be removed:
1. Revoke the Key: The user must click Revoke API Key in their profile.
2. Permanent Removal: Once revoked, the "Generate" button will not reappear, and the entire API Key section will vanish from that user's view upon refresh.
Moreover, we can use the REST API endpoint to revoke all the API keys using the Admin token. Similarly, we can achieve the same by navigating to: Administration > Artifactory Settings > Artifactory Security (or "User Management | Settings" in classic navigation) > "Remove API Keys for All Users" as shown below.
Configuration Reference
To manually enforce this (if on a version earlier than 7.98), ensure your 'access.config.latest.yml' (located at '$JFROG_HOME/artifactory/var/etc/access/') includes:
security:
authentication:
disable-api-key-creation: true
Note:
If you are manually editing configuration files, always rename the modified file to 'access.config.import.yml' and restart the service for changes to take effect. For more information, you can refer to this official documentation: Block Creation of New API Keys
Related Documentations:
Upload the Access YAML File
JFrog API Key Deprecation for Self-Hosted Customers