Enhanced Account Security: API Keys and Legacy User APIs

By Sparkforge Support Team ·Last reviewed May 3, 2026

Enhanced Account Security stops auto-generation of location API keys, removes keys from API responses, and disables legacy v1 User APIs. It became the default on June 17, 2024.

Enhanced Account Security tightens API access to reduce the blast radius if a key leaks. It became the default for all accounts on June 17, 2024. Opting out is possible but not recommended.

What it changes

  • No auto-generated location API keys. Creating a location via API or UI no longer mints an API key automatically. Generate keys manually in the UI when you need them.
  • API keys excluded from Location CRUD responses. Previously, Location CRUD APIs returned the key in the response payload. Now you must log in and pull the key from the UI.
  • Legacy v1 User APIs disabled. Create, update, and delete user endpoints on API v1 are off. Those endpoints could be abused if an API key was compromised, so they're shut down.

Important caveat

Enabling Enhanced Account Security does not restore API key generation for locations where the key was previously revoked. The setting only applies to locations with an active API key.

Opting out

The opt-out toggle lives in Settings. Sparkforge strongly advises against disabling Enhanced Account Security, as the legacy behavior leaves your account and data exposed.

Frequently Asked Questions

Will enabling Enhanced Account Security restore a revoked API key?
No. The setting only applies to locations that still have an active API key. Revoked keys must be regenerated separately.
How do I get a location API key now?
Log into the location in the UI and generate the key manually. Auto-generation through the API is disabled.
Can I still use v1 User APIs?
No. Create, update, and delete user endpoints on API v1 are disabled because they can be abused if an API key leaks.
Can I opt out of Enhanced Account Security?
Yes, in Settings, but Sparkforge strongly recommends against it. The legacy behavior is a security risk.

Was this article helpful?

Related Articles