What is a NET Key?
A NET Key (Netflix Edge Token Key) is a credential issued by Netflix that represents your vendor organization within Netflix’s identity system. It enables your applications to make secure, authenticated API calls to Netflix’s internal services.
NET Keys are designed with security in mind:
- They expire after a configured period, limiting exposure if a key is compromised.
- They are scoped to specific roles and data sets, following least-privilege principles.
- They can be revoked or reissued at any time.
Key Terminology
| Term | Definition |
| NET Key | A Netflix Edge Token Key - a credential issued to your vendor for authenticated access to specific Netflix APIs. |
| Vendor ID | A unique identifier assigned to your vendor organization within Netflix systems. Your NET keys are scoped to this ID. |
| Access Manager | The Netflix self-serve access management portal. As a vendor user, you can use Access Manager to view, reissue, create, and revoke your vendors NET keys. |
| Role | A set of permissions that define what data or APIs a NET Key can access. Roles are granted to your NET Keys by your Netflix contact. |
Getting Access to Access Manager
Before you can manage NET Keys, you need a user account and to be granted access to the Access Manager app.
Your Netflix contact will set this up for you. If you are being provisioned with a new user account, you will receive an email to activate your account - you need to click through and set your password to activate your user account.
If you already have a user account to log in to Netflix Studio apps, you will receive an email notification letting you know that you have been granted access to Access Manager. You can click through from this email to log in, or go directly to https://accessmanager.netflixstudios.com/.
What You Can Do in Access Manager
Once you log in to Access Manager, click on the section “NET Keys” in the navigation menu. You will be able to see all NET Keys created for your vendor.
For each NET Key, you can see:
- Description: text field describing what the NET Key is intended to be used for
- Status: is the NET Key active or expired
- Expired: the date on which the NET Key will expire
- Token ID: unique identifier for that specific NET Key instance. It changes every time the NET Key is renewed.
- UUID: persistent unique identifier for the NET Key
- Access Readiness: shows “no access” if the NET Key has not been granted a role, shows “Ready to use” if the NET Key has been granted a role.
The following actions are available to you:
Reissue a NET Key
Reissuing a NET Key refreshes the access token and resets the expiration date. The key’s roles and permissions remain unchanged.
Use this when a key is approaching expiration or if the current token needs to be rotated for security reasons.
Create a NET Key
You can create a new NET Key scoped to your vendor. When a new key is created, you will be able to save the access token at that time.
| Important: As a vendor user, you cannot grant roles to NET Keys. After creating a new NET Key, reach out to your Netflix contact to request that the appropriate roles be granted before the key can be used to access Netflix APIs. |
Revoke a NET Key
Revoking a NET Key immediately prevents it from being used. Use this if a key is compromised, no longer needed, or needs to be replaced.
Revocation is permanent — a revoked key cannot be restored. If you need to restore access, create a new NET Key and have your Netflix contact re-grant the necessary roles.
Expiration Notifications
Every NET Key is required to have an expiration date. You will receive email notifications 90, 30 and 7 days prior to the expiration date for any NET Keys associated with your vendor.
Limitations
As a vendor user in Access Manager, there are some actions reserved for your Netflix contact:
- Granting or editing roles on a NET Key
- Viewing or modifying NET Keys for other vendors
- Accessing other Netflix internal systems beyond your vendor’s NET Key management
If you need roles added or changed on a NET Key, please contact your Netflix internal contact.