In modern system architectures, API keys are the cornerstone of service integration and identity authentication. However, on enterprise-level platforms like digiRunner, obtaining a key isn't just a single-click action. It involves a robust multi-level internal review process designed to ensure security and access control.

For users new to the platform, this process might seem complex. You might be asking: "Where do I start?", "Why does my application need sign-off?", or "How do I track my request?".

This guide breaks down every step within the digiRunner system—from initiating an application to generating your final signature. Whether you are a developer or an administrator, this tutorial ensures you can navigate the approval workflow smoothly.

The 6-Stage Lifecycle of an API Key

We have divided the entire process into six actionable stages: application, submission, approval, issuance, usage, and management.

OpenTPI API Key Lifecycle diagram illustrating a linear 6-step workflow

(Figure 1: The 6-step API key lifecycle)

Stage 1: Initiating the Application

The journey begins with filling out the application form correctly.

OpenTPI interface for creating API keys, managing quotas, and selecting APIs.

(Figure 2: Configuring the API Key Application)

Navigate to the Page: After logging in, go to Application Forms → API Key.
Select the Client: Search for and select the Client you are applying for.
- 💡 Pro Tip: If this is your first time applying for a specific Client, you might see the message "1298 - No information found". Don't panic—this is normal. Simply click Apply to proceed.
Fill in Required Fields:
- API Key Name: Give it a recognizable name.
- Effective/Expiry Date: Define the lifecycle of the key.
- Use Quota: Enter -1 for unlimited access, or a specific number to limit calls.
- Description: Briefly explain the purpose of this key.
Select APIs: Use the Select API window (or the 🔍 icon) to choose the APIs this key needs to access. Ensure these APIs are already registered in API Management → API List.
Save Draft: Once confirmed, click Save. Your request is now stored under Application Forms → Applications.

Stage 2: Submitting for Approval

Creating a draft doesn't start the review. You must manually submit it.

Navigate to Application Forms → Applications.
Locate your draft record.
Click Submit for Review and then Confirm.

Status Update: Your application will change to Pending order, officially entering the approval workflow.

Stage 3: The Approval Workflow (Admin Side)

Security is paramount in digiRunner. The system supports a two-level approval mechanism.

Configuration: Administrators must configure reviewer roles in Approval Flow Settings beforehand.
Level 1 Review: The reviewer sees the request in their "Pending order" list. They must click Sign-off → Approve.
Level 2 Review: If configured, the request automatically flows to the second reviewer, who must also perform Sign-off → Approve.

Once all levels are cleared, the API Key status updates to "Approved" and becomes active on its Effective Date.

Stage 4: Issuance and Notification

You don't need to refresh the page constantly. The system handles issuance automatically.

Timing: Approximately 10 minutes after final approval, the system sends a notification email.
The Email: Look for the subject "【digiRunner】Notification API Key Authorization Result".
Content: This email contains your API Key (Public Key) and Secret Key (Private Key/X-API-Key).

Stage 5: Validating Your New API Key (DGRK)

Congratulations! You have your credentials. Here is how to use them for testing:

Select Authentication: Choose DGRK as your Authorization type.
Input Public Key: Enter the API Key received in your email.
Generate Signature: Use your Secret Key to calculate the DGRK signature.
Test: Click the Test button to verify the API response.

Stage 6: Tracking and Lifecycle Management

Effective API governance requires tracking.

Audit Trails: Visit System Information → API Key Approval History to view the full sign-off and issuance logs.
Maintenance: Use the Applications page to view, edit, or revoke existing keys.

Critical Precautions for a Smooth Process

To avoid your application getting stuck, keep these prerequisites in mind:

SMTP Configuration is Mandatory: You must complete SMTP setup before applying. If the system cannot send emails, the process will break, and you won't receive your key.
Protect Your Secret Key: Your Secret Key functions like a password. Never expose it in public repositories or client-side code.
Check Date Settings: The key is valid strictly between the Effective Date and Expiry Date.
Verify Reviewer Roles: If an administrator hasn't assigned roles in Approval Flow Settings, your application will remain stuck in "Pending order" indefinitely.

FAQ: Common Issues

Q: Why is my application stuck in "Pending order"?

A: This usually happens if the administrator has not configured the "Approval Flow Settings" or if the assigned reviewer has not performed the "Sign-off" action.

Q: I didn't receive the API Key email. What happened?

A: Check your spam folder first. If it's not there, ensure that the SMTP server was correctly configured in digiRunner before you submitted the application.

Q: Can I limit how many times an API key is used?

A: Yes. In the "Use Quota" field, enter a specific number. Entering -1 means unlimited usage.

Ready to Secure Your AI-Native Integrations?

Now that you understand the lifecycle of the digiRunner API Key, it’s time to put your secure credentials to work.

Choose your next step:

→ Try digiRunner Open Source on GitHub: Clone the repo and test the secure approval workflow in your local environment.

→ Technical Documentation: Deep dive into DGRK Authentication patterns and client-side signature implementation.

→ Insights & Community: Join the discussion on API security best practices and governance strategies.

Security is the foundation of the AI-Native future. You have the key. Now, build the gateway.

🚀 Continue Your AI-Native Journey

Unlock more strategic insights for enterprise API security and governance →

The Operator’s Handbook: Orchestrating Cost, Latency, and Security in Production-Grade AI Architectures

👉 [Read Full Article]

Mastering API Security Why digiRunner Uses JWT & JWS for Better Developer Experience

👉 [Read Full Article]

Debugging 401 Unauthorized A Developer’s Guide to JWT Errors in digiRunner

👉 [Read Full Article]

Mastering the digiRunner API Key: A Complete Guide to Application, Approval, and Security