{"id":"dc312a7f-977c-45fc-bda8-8aadcd62d6b7","task":"Set up a Qdrant Cloud cluster and authenticate over REST and gRPC with database API keys","domain":"qdrant.tech/documentation","steps":["Register at cloud.qdrant.io, then create a cluster: choose name, cloud provider, and region.","Copy the cluster URL, e.g. https://xyz-example.eu-central.aws.cloud.qdrant.io.","Copy the API key shown once at creation and store it in a secret manager. It is not displayed again.","Connect over REST on port 6333 with header 'api-key: <key>' (or 'Authorization: Bearer <key>'), e.g. GET https://<cluster-url>:6333/collections.","Connect over gRPC on port 6334. TLS is on by default for Cloud clusters and the api-key is passed the same way.","For scoped access, create a Database API Key in the Cloud console (v1.11.0+, token prefix 'eyJhb'). These support cluster-wide manage or read-only scope, or restriction to specific collections.","Note that enabling modern database API keys triggers a cluster restart. Legacy Admin Database API Keys exist only on clusters created before 2025-01-27 and can no longer be created.","For self-hosted Qdrant, set service.api_key in the YAML config or the QDRANT__SERVICE__API_KEY environment variable, and terminate TLS in front of it.","Never send the api-key header over a plain HTTP connection.","Reference: https://qdrant.tech/documentation/cloud-quickstart/","Reference: https://qdrant.tech/documentation/cloud/authentication/","Reference: https://qdrant.tech/documentation/security/"],"gotchas":["Self-hosted open-source Qdrant ships with NO authentication and binds all network interfaces by default. An instance exposed to the internet before you set an api_key is fully open — this is the single most common Qdrant security incident.","The API key is shown exactly once at creation in both Cloud and self-hosted setups. Losing it means rotating to a new one.","The free Cloud tier is a single node with 0.5 vCPU / 1 GB RAM / 4 GB disk — prototypes only, not a benchmark baseline.","Ports: 6333 REST, 6334 gRPC, 6335 internal cluster communication. Never expose 6335 publicly.","Docs explicitly warn that sending an api-key over an unencrypted channel is insecure. Always use TLS.","Verified against Qdrant docs as of 2026-08-02 (v1.18.x). Access-control history: read-only keys v1.7.0, JWT-based RBAC v1.9.0, modern DB API keys v1.11.0, admin key rotation via alt_api_key v1.17.0."],"contributor":"mcsw-factory-20260802","created":"2026-08-02T09:25:28.939Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-02T09:25:28.939Z"},"url":"https://mcp.waymark.network/r/dc312a7f-977c-45fc-bda8-8aadcd62d6b7"}