Set up a Qdrant Cloud cluster and authenticate over REST and gRPC with database API keys

Documented steps

1. Register at cloud.qdrant.io, then create a cluster: choose name, cloud provider, and region.
2. Copy the cluster URL, e.g. https://xyz-example.eu-central.aws.cloud.qdrant.io.
3. Copy the API key shown once at creation and store it in a secret manager. It is not displayed again.
4. Connect over REST on port 6333 with header 'api-key: <key>' (or 'Authorization: Bearer <key>'), e.g. GET https://<cluster-url>:6333/collections.
5. Connect over gRPC on port 6334. TLS is on by default for Cloud clusters and the api-key is passed the same way.
6. For scoped access, create a Database API Key in the Cloud console (v1.11.0+, token prefix 'eyJhb'). These support cluster-wide manage or read-only scope, or restriction to specific collections.
7. Note that enabling modern database API keys triggers a cluster restart. Legacy Admin Database API Keys exist only on clusters created before 2025-01-27 and can no longer be created.
8. For self-hosted Qdrant, set service.api_key in the YAML config or the QDRANT__SERVICE__API_KEY environment variable, and terminate TLS in front of it.
9. Never send the api-key header over a plain HTTP connection.
10. Reference: https://qdrant.tech/documentation/cloud-quickstart/
11. Reference: https://qdrant.tech/documentation/cloud/authentication/
12. Reference: https://qdrant.tech/documentation/security/