API keys authenticate your applications to the gateway. They’re issued from the dashboard’s Configuration → API keys page (/dashboard/configuration/api-keys) and pushed to every attached gateway, so the same key works on any gateway the owning organization has online.
Open API keys
The list view shows, per key:
| Column | Notes |
|---|
| Name | Your label — whatever you name the key at creation. |
| Owner | Organization member the key belongs to. |
| Key | Masked preview with a copy-to-clipboard button. |
| Status | active, inactive, expired, or revoked. |
| Expires | Expiration date if set. |
| Last used | Most recent request timestamp. |
| Created | When the key was created. |
| Requests | Total requests served. |
| Usage | Percentage of total traffic across all your keys. |
- Search — by name or key preview.
- Status dropdown — All, Active, Inactive, Expired, Revoked.
- Sortable columns — Name, Owner, Status, Requests.
Create a key
Click Create Key. The form has two tabs.
Basic
| Field | Required | Notes |
|---|
| Key Name | Yes | What you’ll see in logs (e.g. Production API). |
| Expiration | No | Never, 30d, 60d, 90d, 180d, 1y. |
| Requests/min | No | Per-key rate limit. |
| Tokens/min | No | Per-key token rate limit. |
| Budget ($) | No | Hard USD cap; requests are blocked when exceeded. |
| Budget Alert Thresholds (%) | Shown if budget set | Comma-separated percentages (e.g. 50,80,100). Triggers notifications. |
| Ephemeral Token | No | Issues a short-lived delegated token instead of a standard key. |
| Expires In (seconds) | Shown if ephemeral | TTL for the ephemeral token. Default 3600. |
| Allowed Providers | No | Per-provider toggles. All on = no restriction. |
Advanced
- Allowed Models — comma-separated allow-list (
gpt-4o, claude-3.5-sonnet). Empty = all enabled models.
- IP Allowlist — CIDRs or IPs (
192.168.1.0/24, 10.0.0.1). Empty = any IP.
- Metadata (JSON) — arbitrary tags echoed back in logs (e.g.
{"team": "backend", "env": "production"}).
MCP
- MCP Enabled — toggle. Off means this key cannot use any MCP server or tool.
- MCP Access Mode —
Allow All, Deny All, Allow List, Deny List.
- Allowed / Denied MCP Servers — comma-separated server names, shown when the matching mode is picked.
- MCP Tools — per-server tool picker with checkboxes; searchable.
The one-shot reveal
After you click Create Key, the secret is shown once in a green success box:
- Message: “API Key created! Copy it now”.
- Full key in a monospace, select-all code block.
- Copy button (flashes to Copied! for 2 seconds).
- Warning: “This key will not be shown again. Make sure to save it securely.”
- Done button to dismiss.
If you lose the secret, rotate the key to get a new one — there is no retrieval flow. Put it in your secrets manager the first time.
Row actions
From the list: the trash icon on each row deletes the key with a confirmation (“Delete API Key: Are you sure you want to delete ‘{name}’? This action cannot be undone.”).
Clicking a row opens a detail dialog with more actions:
| Action | What it does |
|---|
| Edit | Change name, rate limit, or MCP servers. |
| Rotate Key | Old secret stops working immediately; new secret shown once, same copy flow as creation. |
| Ephemeral Token | Generate a short-lived (default 1h) delegated token from this key. |
| Deactivate | Shown when status is active. Key stops authenticating until reactivated. |
| Activate | Shown when status is inactive or revoked. |
| Delete | Permanent. Same confirmation as the row action. |
Use a key
curl https://<your-gateway>/v1/chat/completions \
-H "Authorization: Bearer <your-key>" \
-H "Content-Type: application/json" \
-d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"hi"}]}'
Notes
- Keys are organization-scoped, not single-gateway. A key works against any gateway the owning org has online. Per-gateway scoping is tracked as a future feature.
- Admins can use Create Key for User to mint a key on behalf of another organization member; the key is then owned by that user.
- Every creation, rotation, activation, and deletion is audit-logged on each gateway the key touches (local-only, see Logs & traces).
