How to manage the PD AI Assistant API key in Blesta
PD AI Assistant’s API is for your own authorised systems to ask questions or run a bounded agent task through the configured AI provider. Its module API key is a powerful installation credential, separate from provider credentials and MCP Hub connection tokens.
Review the scope first
Open PD Modules → PD AI Assistant → Settings → Advanced → API. Read the current key status and the endpoint shown for this installation. Do not construct an endpoint from another site or billing platform.
The released module exposes one shared API key, not an independent key and permission profile per integration. It is not a signed-in-customer credential and does not inherit the client scope of a similarly named MCP Hub connection. Keep it with systems authorised for this staff-oriented capability.
Generate and store it
- Choose Generate key when no key is configured.
- Read and confirm the generation prompt.
- Copy the newly displayed API key while it is available.
- Store it in the caller’s supported secret settings.
- Record which authorised integrations depend on this key, without copying the secret into a content repository.
The key is shown once. Closing the display does not provide a later Show key operation. Never place it in an endpoint URL, customer-facing JavaScript, screenshot or support ticket.
Replace an existing key
Use Regenerate key and confirm the notice when a replacement is intended. The previous key stops working immediately. Update every integration using it and verify the intended caller before assuming the handover is complete.
There is no overlapping old/new key period or per-integration rotation control in this form. A replacement should be planned around the systems sharing it; a changed display name elsewhere does not change this credential.
Revoke access
Use Revoke and confirm when the module API should stop authenticating callers. Revocation does not remove the provider connection, disable the staff assistant or undo completed requests.
Check the saved API status after a change. If a request had an uncertain result, reconcile its actual outcome before retrying with a replacement credential. Keep API key management separate from changing the module’s licence or the AI provider account.
See the PD AI Assistant Blesta guide for related tasks, or explore PD AI Assistant.
