Neo4j API Keys Management

Neo4j API keys are read-only database credentials for querying your graph directly, from the external Neo4j Browser, your own scripts, or a Neo4j driver. They are most useful when SSO is not configured for direct Neo4j access.

Who can manage them

Open API Keys from Settings. Members, Operators, and Admins can create and manage Neo4j API keys; Viewers cannot.

Creating a key

Auto-generated username

1. Click Generate Key.
2. A username is generated from three NATO phonetic words (e.g. alpha-bravo-charlie), and a secure password is generated with it.
3. Copy both immediately. The password cannot be retrieved later.

Custom username

1. Enter a name in the Custom username field. It must be 3 to 50 characters, letters/numbers/hyphens/underscores only, and cannot contain @ (reserved for OIDC users).
2. Click Generate and copy the credentials.

Managing users

All Neo4j API key users in your tenant are listed in a table. OIDC users (those containing @) are not shown here; manage them from Team Members if Neo4j SSO is configured. To remove a key, click Delete on its row and confirm; the user is removed from Neo4j immediately.

Using the credentials

Every key is read-only via the Neo4j reader role: it cannot modify data, change its own password, or access system databases. Passwords are 20 characters and are shown only once.

Neo4j Browser

Open the external Neo4j Browser (linked from the Graph page), then enter the username and password at the login screen. Leave the database as the default (neo4j).

Programmatic access

Connect with any Neo4j driver using your tenant's connection URI:

<NEO4J_URI>

Python (execute_query)

from neo4j import GraphDatabase

URI = "<NEO4J_URI>"
AUTH = ("your-username", "your-password")

with GraphDatabase.driver(URI, auth=AUTH) as driver:
    driver.verify_connectivity()
    records, summary, keys = driver.execute_query(
        """
        MATCH (a:AWSAccount)
        RETURN a.id AS id, a.name AS name
        LIMIT 5
        """
    )
    for record in records:
        print(record["id"], record["name"])  # or: print(record.data())

Python quick start: https://neo4j.com/docs/python-manual/current/

JavaScript (executeQuery)

const neo4j = require('neo4j-driver');

const URI = '<NEO4J_URI>';
const USER = 'your-username';
const PASSWORD = 'your-password';

const driver = neo4j.driver(URI, neo4j.auth.basic(USER, PASSWORD));

async function main() {
	const { records, summary } = await driver.executeQuery(`
    MATCH (a:AWSAccount)
    RETURN a.id AS id, a.name AS name
    LIMIT 5
  `);

	for (const r of records) {
		console.log(r.get('id'), r.get('name'));
	}

	await driver.close();
}

main().catch(console.error);

JavaScript quick start: https://neo4j.com/docs/javascript-manual/current/

For AI assistants, use the SubImage MCP server. It supports read-only Cypher queries without separate Neo4j credentials.

Troubleshooting

• "Username already exists": the name is taken; pick another or use auto-generation.
• "This username is reserved": you picked a system username; choose a different one.
• Authentication failed in the Neo4j Browser: recheck the copied credentials, confirm the user has not been deleted, and confirm you are connecting to the correct instance.

SSO fallback

When Neo4j SSO is configured, users can authenticate through the identity provider, and API keys remain available as a fallback. When it is not configured, API keys are the primary method: the Graph page shows a notice, and you provision a key to query Neo4j directly.