Purpose
Understand who can open the API Keys page, what happens when credentials are not provisioned, and how errors are displayed.
Console path: API Keys.
Sidebar visibility
| Property | Value |
|---|---|
| Nav label | API Keys |
| Path | /api-keys |
| Icon | Key icon |
| Position | Primary sidebar, after Support tickets |
| Gate | None — visible to all authenticated users (unlike Bappy or Whitelabel modules) |
The sidebar link is always shown when logged in, but the page returns 403 Forbidden if your session cannot resolve an organization.
Who can access
| User state | GET /api-keys | POST /api-keys/regenerate-secret |
|---|---|---|
| Guest | Redirect to login | — |
| Authenticated, no resolvable organization | 403 Forbidden | 403 Forbidden |
| Authenticated + organization in JWT | 200 — full page | Allowed if Client ID is configured |
Organization resolution: JWT organization claim → match organizations.keycloak_org_id.
There is no separate admin vs member role check in the API Keys controller — any org member with a valid session can view credentials and regenerate the secret.
Not configured state
When keycloak_m2m_client_id is empty:
| Element | Copy |
|---|---|
| Badge | Not configured |
| Description | Your organization does not have API credentials yet. Contact support to provision a client. |
| Action | Contact [email protected] button (mailto) |
| Credentials card | Hidden |
| Rotate secret | Not available |
Provisioning is done by OmaxTelecom platform staff (superadmin sets Keycloak M2M client ID on the organization). Partners cannot self-provision from the Console.
Related navigation (not API Keys page)
| Sidebar item | Path | Purpose |
|---|---|---|
| Documentation | /documentation | Embeds partner docs (docs.omaxtelecom.com) |
| Developer docs | /developer-docs | Embeds developer portal (developer.omaxtelecom.com) |
On the API Keys page itself, View API docs links to https://developer.omaxtelecom.com/introduction (introduction), not the embedded sidebar route.
Flash error toasts
Shown via Sonner for 5 seconds when flash.error is set (red toast):
| Trigger | Exact message |
|---|---|
| Regenerate with no client ID | No API client is configured for your organization yet. Contact support. |
| Keycloak / config failure | Runtime message from server (see rotate-secret page table) |
Client-side toasts
| Event | Message |
|---|---|
| Copy success | Client ID copied or Secret copied |
| Copy failure | Could not copy. Select the text and copy manually. |
No success toast on regenerate — use on-page warning alert instead.
Troubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
| 403 on API Keys page | Organization not linked to session | Sign out and back in; confirm your OmaxTelecom ID has an organization assigned |
| Not configured badge | No M2M client provisioned | Email [email protected] to request API access |
| Not set — regenerate to create one | Client ID exists but no secret prefix | Click Regenerate secret to create a new secret |
| Regenerate fails with Keycloak error | Platform misconfiguration | Contact [email protected] with the exact toast message |
| Secret field shows bullets only | Normal masked state | Regenerate only if you need a new secret — full value is shown once after rotation |
| Integrations fail after rotate | Old secret still in use | Update all environment variables with the new secret |
Not available in Console
The API Keys page is not a multi-key manager. These features do not exist in the partner Console:
| Feature | Status |
|---|---|
| Multiple named API keys | No — one Client ID + secret pair per organization |
| Keys list / data table | No |
| Create key form | No — contact [email protected] or platform staff to provision credentials |
| Revoke without rotate | No — only Regenerate secret |
| Scopes / permissions UI | No |
| Expiration dates | No |
| Key naming / labels | No |
| Organization profile section | No — credentials are only on API Keys |
The same credentials authenticate across Bappy, Whitelabel, Telkor, and other OmaxTelecom API surfaces.
Related pages
For authentication flows, endpoints, and request examples, see the OmaxTelecom Developer Portal.