OpenText Core Performance Engineering Platform

This section explains how to use Core Performance Engineering Platform to manage integration services across your performance engineering environment, create access keys for services that require authentication, and generate AI usage reports.

In this topic:

Create access keys

Access keys consist of a Client ID and Client Secret. They are required for services and integrations that use key-based authentication. These access keys support:

• Agents. Authentication for agents, OPLGs, and public APIs. For details, see Agents, OPLG requirements, and Public API.

  Note: Username and password authentication is deprecated for all agents, OPLGs, public APIs, and plugins. Existing users can continue to use it until enforcement begins in a future release.

• Integrations. Authentication for CI pipelines and analytic data integrations. For details, see CI plugins, MCP integration, SiteScope, Git integration, and Time series database streaming.

• Analysis. Authentication for OpenText on‑premises products that stream data into OpenText Core Performance Engineering Analysis. For details, see OpenText Core Performance Engineering Analysis integration.

• Aviator. Authentication for OpenText on‑premises products that use Core Performance Engineering Aviator, such as VuGen. For details, see OpenText Core Performance Engineering Aviator.

To create an access key:

1. From the tenant Navigation menu , select Administration > Core Performance Engineering Platform.

2. On the Access Keys page, click the Create button .

3. If prompted, select the required Core Performance Engineering service (otherwise skip to step 4).

   Service	Description
   OpenText Core Performance Engineering Agent	Required for connecting on-premises components, such as on-premises load generators (Windows and Linux) and public APIs.
   OpenText Core Performance Engineering Integration	Required for CI/CD pipelines, SiteScope, Git, MCP integration, and Time series database integrations.
   OpenText Core Performance Engineering Analysis	Required for streaming data from Professional and Enterprise Performance Engineering. Core Performance Engineering includes this service by default and does not require an additional access key.
   OpenText Core Performance Engineering Aviator	Enables integration with AI capabilities for supported on-premises products. Note: The Aviator service option is displayed only in products where it is supported, such as VuGen version 26.1 and later.

4. In the Access key created window, copy the Client ID and Client Secret.

   Note: The client secret is displayed only once at the time of creation. Store the client secret in a secure location. If the client secret is lost, the access key must be deleted and recreated. For additional information, see To revoke an access key:.

Manage access keys

In addition to creating keys, you can view key details and revoke keys from the Access Keys page.

To view access key details:

1. From the tenant Navigation menu , select Administration > Core Performance Engineering Platform > Access Keys.

2. The Access Keys grid contains the following information.

   UI element	Details
   Client key	The Client ID issued as the access key.
   Service	The service associated with the key: Analysis, Aviator, Agent, or Integration.
   Last access	The date and time the access key was last used.
   Creation time	The date and time the access key was generated.

To revoke an access key:

1. Sign in:

   • VuGen users: Sign in to MyAccount and select your Core Performance Engineering Aviator tenant.

   • Core Performance Engineering Analysis users: Sign in to your Core Performance Engineering Aviator tenant.

2. From the tenant Navigation menu , select Administration > Core Performance Engineering Platform > Access Keys.

3. Select the key to revoke.

4. Click the Revoke button , and confirm. The access key is deleted from the database.

Automatic access key expiration

For security reasons, automatic expiration is enabled by default for access keys. Automatic expiration reduces the lifetime of an access key by enforcing regular changes every 90 days by default.

• Account administrators can activate, deactivate, and modify the expiration frequency at the account level in MyAccount.

• When enabled, email notifications are sent to key owners 30 days, 7 days, and 1 day before expiration.

To customize the expiration policy:

1. Sign in to MyAccount and click the Settings button .

2. Select the account you want to modify and open the Security tab. The Custom OAuth expiration policy option is enabled by default with an expiration frequency of every 90 days.

3. In the Account configuration area, click the Edit button , and modify the expiration policy as required:

   • Select an expiration frequency between 90 and 360 days in 30-day increments.

   • To deactivate automatic key expiration (not recommended), clear the Custom OAuth expiration policy checkbox. Click Continue to confirm that you are aware of the increased security risks and assume full responsibility for deactivating the feature.

4. Click OK to save the changes. All keys of all products associated with the specific account inherit these settings and have the same lifetime.

5. The OAuth client area in MyAccount displays the client instances created for the logged-in user. Any user with a client instance can manually refresh the key before it expires.

Access key guidelines and best practices

The following guidelines and best practices apply when working with access keys:

• A user cannot have more than two access keys at one time. This encourages you to rotate active keys. To assign a new access key to a user with two access keys, revoke an existing one.

• Access keys are per tenant. If the same user exists in multiple tenants, the user must have a separate access key for each tenant.

• If your account admin chooses not to enforce an expiration policy, we still recommend rotating access keys periodically.

• The recommended lifetime of an access key is 90 days. Using an access key for more than 12 months is considered bad security and is not recommended.

• Do not embed access keys directly into your code.

• Remove unused access keys.

Your organization may have different security requirements and policies than those described in this section. The suggestions provided here are intended as general guidelines.

See also

• OpenText Core Performance Engineering Aviator
• Tenant management