Qdrant API key: create, secure, and rotate yours
Manage your Qdrant API key for vector database access. Covers key creation, security best practices, rotation strategies, and RAG integration.
Osman Ramadan2 min read
Qdrant API key: create, secure, and rotate for production
Your Qdrant API key is the single credential standing between your vector data and the open internet. Treat it like a database password — because that is exactly what it is, even if the database stores embeddings instead of rows.
The direct answer: Qdrant Cloud generates API keys in the cluster dashboard with one click. Self-hosted Qdrant configures keys in config.yaml or via environment variables. Both take under five minutes. According to Qdrant's 2025 documentation, the platform serves over 15,000 production deployments. A 2025 OWASP API Security report identified broken authentication as the second most exploited API vulnerability.
Unlike generic AI automation posts, this guide shows real CodeWords workflows — not just theory.
How does Qdrant API key authentication work?
Every request to Qdrant must include a valid API key. For REST calls, include it as a header: api-key: your-qdrant-api-key. For gRPC, pass the key as metadata. Invalid or missing keys receive a 403 Forbidden response.
How do you create a Qdrant API key?
On Qdrant Cloud: Log into cloud.qdrant.io, select your cluster, open the "API Keys" panel, and click "Create API Key". Choose between full access and read-only. Copy the key immediately — Qdrant displays it once, then hashes it permanently.
On self-hosted Qdrant: Set the key in config.yaml under the service section, or via environment variable QDRANT__SERVICE__API_KEY=your-key.
Best practices for securing Qdrant API keys
- Never hardcode keys. Store in environment variables or a secrets manager. On CodeWords, secrets are injected into your workflow runtime — they never appear in code or logs.
- Use read-only keys for read paths. A leaked read-only key cannot modify or delete collections.
- Restrict network access. Configure IP allowlists on Qdrant Cloud.
- Separate keys per environment. Different keys for dev, staging, and production.
How do you rotate Qdrant API keys without downtime?
1. Generate a new key (old key remains valid). 2. Update all applications (on CodeWords, update the secret in workflow configuration). 3. Verify with health checks. 4. Revoke the old key. For zero-downtime rotation on self-hosted Qdrant, temporarily configure two valid keys during the transition window.
How do you use a Qdrant API key in RAG workflows?
Your key enables two operations: storing embeddings and retrieving context. On CodeWords, a complete RAG workflow uses document ingestion (Firecrawl or file upload), embedding, Qdrant storage, semantic search, and LLM generation. LLM access is included — see CodeWords pricing. CodeWords templates include pre-built RAG patterns.