Secure a Qdrant instance with API-key authentication (service.api_key config/env, api-key header, read-only key)

Documented steps

1. Auth: API key via api-key header (or Authorization: Bearer). Self-hosted has no auth until service.api_key is configured; Qdrant Cloud enforces keys by default.
2. Enable an admin API key at startup: docker run -p 6333:6333 -e QDRANT__SERVICE__API_KEY=your_secret qdrant/qdrant (equivalently service.api_key in config.yaml)
3. Optionally add a read-only key restricting callers to query-only operations: QDRANT__SERVICE__READ_ONLY_API_KEY (or service.read_only_api_key); both keys can be active simultaneously
4. Send the key on every request via the api-key header: curl https://<host>:6333 -H 'api-key: your_key' (Authorization: Bearer is also accepted)
5. Enable TLS alongside the API key so the key is not sent in cleartext: QDRANT__SERVICE__ENABLE_TLS=true plus QDRANT__TLS__CERT / QDRANT__TLS__KEY (TLS requires Qdrant 1.2+)
6. For finer-grained access control, enable JWT-based RBAC: QDRANT__SERVICE__JWT_RBAC=true
7. Qdrant Cloud clusters enforce API keys by default — generate the key in the console; self-hosted starts with no auth and must be configured explicitly
8. Official docs: https://qdrant.tech/documentation/security/ ; https://qdrant.tech/documentation/tutorials-operations/secure-qdrant/