# Secret key management

> For the complete documentation index, see [llms.txt](https://developers.thoughtspot.com/docs/llms.txt)

Source: https://developers.thoughtspot.com/docs/trusted-auth-secret-key

# Secret key management

## Secret key overview

The `secret_key` allows calling the ThoughtSpot **token request** REST APIs to generate a token for **any user**.

Requests with the `secret_key` do not require any type of user login or admin permissions and the `secret_key` is equivalent to an admin-level login for the token request REST APIs.

The `secret_key` must be stored securely and never exposed to end users in the web browser.

## Enable Trusted authentication to get a secret key

A new secret key is generated when the ThoughtSpot administrator enables **Trusted authentication**.  

> **NOTE:** Starting from 9.2.0.cl, Org administrators can generate a unique secret key for respective Orgs. To enable this feature on your cluster, contact ThoughtSpot Support.

To generate a secret key:

1.  Log in to the ThoughtSpot.
    
2.  If Orgs are configured on your instance, switch to the Org for which you want to generate a secret key.
    
    If the per-Org secret key feature is not enabled on your instance and if you want to generate a separate secret key for each Org, contact ThoughtSpot Support. ThoughtSpot also allows you to generate a secret key at the primary Org (Org 0) level and use it to obtain an authentication token for a user.
    
3.  Go to **Develop** > **Customizations** > **Security settings**.
    
4.  Click **Edit**.
    
5.  To enable trusted authentication, turn on the **Trusted authentication** toggle.
    
6.  To copy the secret key, click **Edit** again, navigate to **Trusted authentication**, and then click the copy to clipboard icon.
    
    The following example shows a ThoughtSpot-generated secret key string.
    
    b0cb26a0-351e-40b4-9e42-00fa2265d50c
    
    This key is required for making API calls to get a token for ThoughtSpot users.
    
7.  Store the key in a secure location.
    
8.  Click **Save Changes**.
    

> **NOTE:** To enable Trusted authentication programmatically, send a POST request to the POST /api/rest/2.0/auth/configure endpoint. For more information, see Configuring authentication settings.

## Request a new secret key

Requesting a new `secret_key` simply involves disabling and re-enabling trusted authentication.

Any previous `secret_key` will be invalidated as soon as Trusted authentication has been disabled.

## Disable Trusted authentication

To disable Trusted authentication, follow these steps:

1.  Log in to ThoughtSpot.
    
2.  If the per-Org secret key feature is enabled and Orgs are configured on your instance, switch to the Org for which you want to disable trusted authentication.
    
3.  Go to **Develop** > **Customizations** > **Security settings**.
    
4.  Click **Edit** and turn off the **Trusted authentication** toggle.
    
    A pop-up window appears and prompts you to confirm the disable action.
    
5.  Click **Disable**.
    
    When you disable Trusted authentication, the validity of your existing secret key expires, and your app may become inoperable. To a new secret key and generate authentication tokens, you must enable **Trusted authentication**.