API keys for server integrations
An API key is a static credential for a documented integration context, allowing access to be tracked and revoked separately from other integrations.
Emby's API-key authentication supplies a static token for integrations that are not tied to one user's login context. A named key lets the server administrator associate that credential with a particular external application or service.
That name describes intended use. The secret value provides the request evidence.
Separate integrations need separate revocation boundaries
| Integration | Original credential relationship |
|---|---|
| Library-report service | Key K1 |
| Home-automation adapter | Key K2 |
| Another application | Key K3 |
The labels are fictional. If K2 must be revoked, K1 and K3 can retain their own credentials. Sharing one key across all three would make the revocation boundary much broader.
This is the reason Emby's documentation recommends a separate API key for each system granted access.
The key accompanies applicable requests
The documented X-Emby-Token header can carry the key. A query parameter is also documented, but a value placed in a URL can appear in URL logs and other records.
An original illustrative fragment is:
X-Emby-Token: EXAMPLE_INTEGRATION_KEY
It is a placeholder rather than a credential for any server. A key being accepted does not eliminate the endpoint's operation requirements or establish that an integration has a fictional set of narrow scopes.
Replacement needs both sides to agree
When changing a credential, the server and integration must agree on the accepted value. Installing a new value in one process while another still uses the old one can create intermittent failures.
Revocation prevents future applicable access under the server's contract. It does not undo files already changed or notifications already sent.
For Emby integrations, record which system uses each credential and distinguish request authentication from the operation it is permitted to perform. Integration permissions develops that effective-access boundary.