# Best way to handle an API key

**URL:** <https://forum.ansible.com/t/best-way-to-handle-an-api-key/43439>\
**Category:** Get Help\
**Tags:** api\
**Created:** [June 17, 2025, 1:05pm UTC](https://forum.ansible.com/t/best-way-to-handle-an-api-key/43439 "2025-06-17T13:05:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ekynox360](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ekynox360/32/8594_2.png) [@ekynox360](https://forum.ansible.com/u/ekynox360)\
**Post date:** [June 17, 2025, 1:05pm UTC](https://forum.ansible.com/t/best-way-to-handle-an-api-key/43439/1 "2025-06-17T13:05:09Z")

</div>

Hi,

I’ve written an Ansible role where I retrieve an API key and persist it using the Register module. This key is obviously only available to this role, but I’d like it to be available to other roles that query the targeted API with this key. What’s the best way to increase the scope of this variable?

Thx 🙂

---

<div class="post-metadata">

**Author:** ![bvitnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bvitnik/32/4132_2.png) [@bvitnik](https://forum.ansible.com/u/bvitnik)\
**Post date:** [June 17, 2025, 2:14pm UTC](https://forum.ansible.com/t/best-way-to-handle-an-api-key/43439/2 "2025-06-17T14:14:34Z")

</div>

Register variable is tied to the host, not the role, but only inside the same play. So in other words, other roles can already access the variable if run in the same play… and for the same host.

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [June 17, 2025, 2:15pm UTC](https://forum.ansible.com/t/best-way-to-handle-an-api-key/43439/3 "2025-06-17T14:15:38Z")

</div>

First, `register` is not a module, it is a keyword that creates a ‘host scoped’ variable. Second, it is not ‘obviouslly role scoped’, this already makes it available to all other roles and plays in the same run.

---

<div class="post-metadata">

**Author:** ![bvitnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bvitnik/32/4132_2.png) [@bvitnik](https://forum.ansible.com/u/bvitnik)\
**Post date:** [June 17, 2025, 2:18pm UTC](https://forum.ansible.com/t/best-way-to-handle-an-api-key/43439/4 "2025-06-17T14:18:29Z")

</div>

@bcoca so it’s available across the plays also? My bad. I was under the assumption that registered variables get cleared at each play. Then it’s even better, they are global for that host.

---

<div class="post-metadata">

**Author:** ![bcoca](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bcoca/32/9269_2.png) [@bcoca](https://forum.ansible.com/u/bcoca)\
**Post date:** [June 17, 2025, 2:25pm UTC](https://forum.ansible.com/t/best-way-to-handle-an-api-key/43439/5 "2025-06-17T14:25:11Z")

</div>

No, you have 3 scopes:

- extra vars: mostly global and overrides all else
- playbook objects: scope is limited to the life of the object and inherited by other playbook objects contained , for example, blocks inherit from play, tasks from blocks. The exception are roles as they CAN export variables up to the play itself (this has a toggle)
- hosts: set\_fact/include\_vars/inventory/vars plugins and register create variables attached to the host, this is accessible across all playbook objects once set.