OpenText Core Performance Engineering Platform

This section explains how to use the Core Performance Engineering Platform to manage integration services across your performance engineering environment, create access keys for services that require authentication, and generate AI usage reports.

In this topic:

Create access keys

An access key includes a Client ID and Client Secret. Access keys are required for the following OpenText Core Performance Engineering services and integrations that use key-based authentication.

Service	Description
Agent	Authentication for agents, OPLGs, and public APIs. For details, see Agents, OPLG requirements, and Public API. Note: Username and password authentication is deprecated for all agents, OPLGs, public APIs, and plugins. Existing users can continue to use it until enforcement begins in a future release.
Integration	Authentication for CI pipelines and analytic data integrations. For details, see CI plugins, MCP integration, SiteScope, Git integration, and Time series database streaming.
Analysis	Authentication for OpenText on‑premises products that stream data into OpenText Core Performance Engineering Analysis. For details, see OpenText Core Performance Engineering Analysis integration.
Aviator	Authentication for OpenText on‑premises products that use Core Performance Engineering Aviator, such as VuGen. For details, see OpenText Core Performance Engineering Aviator.

To create an access key:

1. From the tenant Navigation menu , select Administration > Core Performance Engineering Platform.

2. On the Access keys page, click the Create button .

3. If prompted, select the required OpenText Core Performance Engineering service. Otherwise, continue to the next step.

   For details of the available services, see the table above.

4. In the Access key created window, copy the Client ID and Client Secret.

   Note: The client secret is displayed only once at the time of creation. Store it securely. If it is lost, you must delete and recreate the access key. For details, see To revoke an access key:.

Manage access keys

In addition to creating keys, you can view key details and revoke keys from the Access keys page.

Access key visibility options

An administrator is a user with elevated platform-level visibility and governance capabilities. This role provides visibility into all access keys in your tenant and supports multi-user viewing options through the Show only my keys switch on the Access keys page.

Switch state	Description
Off (default)	Displays all access keys in your tenant, including keys that belong to other users. The Created by column indicates the owner of each key.
On	Displays only access keys that belong to your user account.

The following permissions apply to Platform Admin users on the Access keys page.

Action	Permission
Create access keys	Can create access keys only for their own account.
Revoke access keys	Can revoke only their own keys.

To view access key details:

1. From the tenant Navigation menu , select Administration > Core Performance Engineering Platform > Access keys.

2. The Access keys grid contains the following information.

   UI element	Details
   Client ID	The Client ID issued as the access key.
   Service	The service associated with the key: Analysis, Aviator, Agent, or Integration.
   Created by	Displayed for Admin users when the Show only my keys switch is off. The value identifies the owner of each access key.
   Last access	The date and time the access key was last used.
   Creation time	The date and time the access key was generated.

To revoke an access key:

1. Sign in:

   • VuGen users: Sign in to MyAccount and select your Core Performance Engineering Aviator tenant.

   • Core Performance Engineering Analysis users: Sign in to your Core Performance Engineering Aviator tenant.

2. From the tenant Navigation menu , select Administration > Core Performance Engineering Platform > Access keys.

3. Select the key to revoke.

4. Click the Revoke button , and confirm. The access key is deleted from the database.

Automatic access key expiration

For security reasons, automatic expiration is enabled by default for access keys. Automatic expiration reduces the lifetime of an access key by enforcing regular changes every 90 days by default.

• Account administrators can activate, deactivate, and modify the expiration frequency at the account level in MyAccount.

• When enabled, email notifications are sent to key owners 30 days, 7 days, and 1 day before expiration.

To customize the expiration policy:

1. Sign in to MyAccount and click the Settings button .

2. Select the account you want to modify and open the Security tab. The Custom OAuth expiration policy option is enabled by default with an expiration frequency of every 90 days.

3. In the Account configuration area, click the Edit button , and modify the expiration policy as required:

   • Select an expiration frequency between 90 and 360 days in 30-day increments.

   • To deactivate automatic key expiration (not recommended), clear the Custom OAuth expiration policy checkbox. Click Continue to confirm that you are aware of the increased security risks and assume full responsibility for deactivating the feature.

4. Click OK to save the changes. All keys of all products associated with the specific account inherit these settings and have the same lifetime.

5. The OAuth client area in MyAccount displays the client instances created for the logged-in user. Any user with a client instance can manually refresh the key before it expires.

Access key guidelines and best practices

The following guidelines and best practices apply when working with access keys:

• A user cannot have more than two access keys at one time. This encourages you to rotate active keys. To assign a new access key to a user with two access keys, revoke an existing one.

• Access keys are per tenant. If the same user exists in multiple tenants, the user must have a separate access key for each tenant.

• If your account admin chooses not to enforce an expiration policy, we still recommend rotating access keys periodically.

• The recommended lifetime of an access key is 90 days. Using an access key for more than 12 months is considered bad security and is not recommended.

• Do not embed access keys directly into your code.

• Remove unused access keys.

Your organization may have different security requirements and policies than those described in this section. The suggestions provided here are intended as general guidelines.

See also

• OpenText Core Performance Engineering Aviator
• Tenant management