> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Tenable with API Key – StackOne Hub

> Link a Tenable account in the StackOne Hub using API Key. End-user guide to authorize the integration and start using Tenable actions.

> [!WARNING]
>
> The keys must belong to a Tenable Vulnerability Management user with the Administrator role. A key with a lower role sees only the uuid, id, username and email of each user, and the connection is refused. Each user has one API key pair at a time, so generating new keys stops the old pair everywhere it is used. This connection works only with a Tenable account you sign in to at `cloud.tenable.com`. If you sign in to Tenable at another address, for example in Tenable's FedRAMP Moderate environment, this connection cannot reach your account.

## Prepare the user

The access key and secret key belong to one Tenable user and carry that user's role. Tenable says to use one API key per application, so a dedicated Administrator user keeps these keys from being shared with other tools.

<ul>
  <li>To create one, open the **Users** tab (see "Generate the keys for another user") and click **Create User**. In **Role**, select **Administrator**. Under **Authentication**, select only **API Key**, which Tenable calls an API-only user account. Then generate its keys as described for another user.</li>
  <li>The user needs the **API Key** authentication setting turned on, which allows the user to generate API keys. If the **Generate** button is inactive on **My Account**, ask an Administrator to turn it on.</li>
</ul>

## Generate the access key and secret key

Generate the keys for yourself, or as an Administrator for another user.

**1. Sign in to Tenable**

Sign in to your [Tenable account](https://cloud.tenable.com) as the Administrator user whose keys you want to use.

<ul>
  <li>In the upper-right corner of any page, click the blue user circle, then click **My Profile** to open the **My Account** page.</li>
</ul>

**2. Open API Keys**

In the left navigation of **My Account**, click **API Keys**.

**3. Generate the keys**

At the bottom of the page, click **Generate**. The **Generate API Keys** window warns that this replaces any existing keys. Click **Continue**.

<ul>
  <li>The new keys appear under **Custom API Keys**.</li>
</ul>

**4. Copy both keys**

Under **Custom API Keys**, copy the **ACCESS KEY** and the **SECRET KEY** and store them securely for use later.

<ul>
  <li>Tenable says API keys "are only presented upon initial generation", so copy both before you leave **My Account**. Lost keys cannot be retrieved and must be generated again.</li>
  <li>Paste the **ACCESS KEY** into the **Access Key** field and the **SECRET KEY** into the **Secret Key** field in StackOne Hub.</li>
</ul>

## Generate the keys for another user

An Administrator can generate keys for any user account. Other roles can generate keys only for their own account.

<ul>
  <li>In the left navigation, click **Settings**, click the **Access Control** tile, then click the **Users** tab.</li>
  <li>In the users table, click the name of the user to open the **Edit User** page.</li>
  <li>In the **API Keys** section, click **Generate API Keys**, review the warning, then click **Replace & Generate**.</li>
  <li>Copy the access key and the secret key from the **Generate API Keys** text box before you leave the **Edit User** page. They are shown once and cannot be retrieved later.</li>
  <li>Paste the access key into the **Access Key** field and the secret key into the **Secret Key** field in StackOne Hub.</li>
</ul>

## Know how long the keys last

Tenable does not ask for an expiry date when you generate keys. The keys stop working when new keys are generated for the user, when the user's **API Key** setting is turned off, or when the user is disabled. Tenable recommends rotating API keys on a schedule that fits your security policy.

<ul>
  <li>To stop StackOne from reading your Tenable account, generate new keys for the user, or turn off **API Key** under **Authentication** on the user's **Edit User** page.</li>
  <li>After that, the connection stops working until you paste current keys into StackOne Hub.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Access Key**</li>
  <li>**Secret Key**</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.