Skip to main content
The keys must belong to a Tenable Vulnerability Management user with the Administrator role. A key with a lower role sees only the uuid, id, username and email of each user, and the connection is refused. Each user has one API key pair at a time, so generating new keys stops the old pair everywhere it is used. This connection works only with a Tenable account you sign in to at cloud.tenable.com. If you sign in to Tenable at another address, for example in Tenable’s FedRAMP Moderate environment, this connection cannot reach your account.

​
Prepare the user

The access key and secret key belong to one Tenable user and carry that user’s role. Tenable says to use one API key per application, so a dedicated Administrator user keeps these keys from being shared with other tools.

  • To create one, open the Users tab (see “Generate the keys for another user”) and click Create User. In Role, select Administrator. Under Authentication, select only API Key, which Tenable calls an API-only user account. Then generate its keys as described for another user.
  • The user needs the API Key authentication setting turned on, which allows the user to generate API keys. If the Generate button is inactive on My Account, ask an Administrator to turn it on.

​
Generate the access key and secret key

Generate the keys for yourself, or as an Administrator for another user.

1

Sign in to Tenable

Sign in to your Tenable account as the Administrator user whose keys you want to use.

  • In the upper-right corner of any page, click the blue user circle, then click My Profile to open the My Account page.
2

Open API Keys

In the left navigation of My Account, click API Keys.

3

Generate the keys

At the bottom of the page, click Generate. The Generate API Keys window warns that this replaces any existing keys. Click Continue.

  • The new keys appear under Custom API Keys.
4

Copy both keys

Under Custom API Keys, copy the ACCESS KEY and the SECRET KEY and store them securely for use later.

  • Tenable says API keys “are only presented upon initial generation”, so copy both before you leave My Account. Lost keys cannot be retrieved and must be generated again.
  • Paste the ACCESS KEY into the Access Key field and the SECRET KEY into the Secret Key field in StackOne Hub.

​
Generate the keys for another user

An Administrator can generate keys for any user account. Other roles can generate keys only for their own account.

  • In the left navigation, click Settings, click the Access Control tile, then click the Users tab.
  • In the users table, click the name of the user to open the Edit User page.
  • In the API Keys section, click Generate API Keys, review the warning, then click Replace & Generate.
  • Copy the access key and the secret key from the Generate API Keys text box before you leave the Edit User page. They are shown once and cannot be retrieved later.
  • Paste the access key into the Access Key field and the secret key into the Secret Key field in StackOne Hub.

​
Know how long the keys last

Tenable does not ask for an expiry date when you generate keys. The keys stop working when new keys are generated for the user, when the user’s API Key setting is turned off, or when the user is disabled. Tenable recommends rotating API keys on a schedule that fits your security policy.

  • To stop StackOne from reading your Tenable account, generate new keys for the user, or turn off API Key under Authentication on the user’s Edit User page.
  • After that, the connection stops working until you paste current keys into StackOne Hub.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Access Key
  • Secret Key
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.