14.2Preparing the API key in SYNERGY Management Gateway

The credential needs an API key and the Client ID of the key's binding. Both are created in the web console; Chapter 12, API keys, describes the screens in full. In short:

1. 1Create an API key for the integration, and choose a role that holds only the permissions the workflows need.
2. 2Copy the key when it is shown. It is displayed once.
3. 3Open the key's settings page (Edit in the key's row menu) and, in the Directory section, select Link AD Server.
4. 4In AD Server, choose the directory the workflows should manage. In Client ID, keep the suggested value or enter your own (up to 100 characters).
5. 5Select Link Server. The link is saved at once.
6. 6Copy the Client ID with the Copy button on the linked row.

Three settings on the key decide how far an unattended workflow can go on its own:

• Its role. A key can only do what its role allows, and never more than its owner can do at the time of each request. If the owner later loses a permission, or loses access to the linked directory, the key loses it too.
• Its supervision level. Every API key has a supervision level — Act without asking, Ask before destructive and security changes (the default) or Ask before every change — that decides which of its changes wait for a person's approval. This is explained in "Changes that wait for approval" below, and in full in Chapter 10, Operation policies, attribute policies and agent supervision.
• Skip the always-ask wait. Exempts the key from operations an administrator has set to always ask agents. Protected objects and the key's own supervision level still apply (see Chapter 12, API keys).

If the key has Allowed addresses, add the address of the n8n host, or every request from n8n is refused.

Tip: Create one API key per integration, with the narrowest role that works. A leaked key for a reporting workflow that only reads users is far less dangerous than a leaked key that can delete accounts.