# API Connection
This page describes how to create API keys and configure your
[SDK installation](installation.md#enterprise-python-sdk) to connect to your FiftyOne
Enterprise deployment.
All actions taken via API connections are authenticated based on the user
associated with the API key, which means that concepts like user roles and
dataset permissions *are enforced*.
## Configuring an API connection
You can configure an API connection by adding an API URI and API key to your
FiftyOne config as described below:
| Config field | Environment variable | Default value | Description |
|-----------------------|--------------------------------|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `api_uri` | `FIFTYONE_API_URI` | `None` | The URI of your FiftyOne Enterprise API. Ask your deployment admin for this value. |
| `api_key` | `FIFTYONE_API_KEY` | `None` | Your FiftyOne Enterprise API key. [See here](#enterprise-generate-api-key) to
generate one. |
| `api_compressor` | `FIFTYONE_API_COMPRESSOR` | `lz4` | If data being sent to the server should be compressed. Recommended when on VPN or
poor internet connection. Defaults to `lz4` but accepts `none`, `bz2`, `zlib` and
`lzma`. |
| `api_transfer_method` | `FIFTYONE_API_TRANSFER_METHOD` | `bytes` | How data should be encoded and transferred to the server. Default is `bytes` but
accepts `str` as well which will base64 encode and convert to string before sending. |
For example, you can set environment variables:
```shell
export FIFTYONE_API_URI=XXXXXXXX
export FIFTYONE_API_KEY=YYYYYYYY
```
See
[this page](../user_guide/config.md#configuring-fiftyone) for more information about using your
FiftyOne config.
## Connecting as a service account
[Service accounts](roles_and_permissions.md#enterprise-service-accounts) connect to FiftyOne
Enterprise the same way as human users — by setting `FIFTYONE_API_URI` and
`FIFTYONE_API_KEY` to the service account’s API key:
```shell
export FIFTYONE_API_URI=XXXXXXXX
export FIFTYONE_API_KEY="your-service-account-api-key"
```
#### WARNING
Service account API keys are only displayed once at generation time. Copy
and store the key securely immediately — it cannot be recovered if lost.
See [Service account management](management_sdk.md#enterprise-sdk-service-account-management)
for how to generate API keys for a service account.
## Generating an API key
Users can generate and manage API keys via the UI or the
[Management SDK](management_sdk.md#enterprise-management-sdk).
#### NOTE
Guests cannot create or use API keys.
### Generating keys via the UI
You can access API key management features by clicking on your account icon in
the upper-right of the FiftyOne Enterprise App and navigating to the
“Settings > API keys” page.
A new key can be generated by clicking on “Generate API key” and optionally
providing a nickname for the key to identify what it is used for. Click
“Generate key” to complete the process.
Finally, copy the key and configure it locally using one of the options
[described here](#enterprise-api-connection).
#### WARNING
Keys are only shown once. Copy the key immediately, as it will not be
accessible again. API keys provide full programmatic access to perform
actions as a user, so secure them as you would a password!
### Generating keys programmatically
You can also use
[`generate_api_key()`](management_sdk.md#fiftyone.management.api_key.generate_api_key) to
generate API keys programmatically.
#### NOTE
Admins can generate API keys for other users, if desired.
## Deleting an API key
To delete a key and remove its access, find the key to delete in the list and
click “Delete”.
You can also programmatically delete API keys via
[`delete_api_key()`](management_sdk.md#fiftyone.management.api_key.delete_api_key).
#### NOTE
Admins can delete API keys for other users, if desired.