Create PAN-OS credentials

Prepare a dedicated account

1. 01

   Open the firewall administration UI

   Use an administrator authorized to create roles and accounts.

2. 02

   Define the role

   Under Device > Admin Roles, allow the required XML API export, operational and configuration reads.

3. 03

   Create the administrator

   Under Device > Administrators, create configproof-reader and assign the profile.

4. 04

   Apply through your change process

   Have the administrator commit required changes, then test from the collector workstation.

Do I need to generate an API key manually?

Use the dedicated username/password; the app obtains an API key. Where Use an API key instead is available, supply an existing firewall or Panorama XML API key.

For manual generation, use an approved HTTPS API client with type=keygen. Store the returned key securely and exclude it from screenshots and logs. See the official authentication guide below.

Check source access

• Reach the management HTTPS endpoint from the collector.
• Allow the active account from this source address.
• Verify export and identity permissions, not just sign-in.
• Verify the device before allowing an internal self-signed certificate.

Use the credential locally

Choose Firewall or Panorama, the management address and API (HTTPS). Enter the account or API key and separate workspace token. Collect the firewall.