Skip to main content

​
What this is for

API keys authenticate your applications when they call the gateway. Each key carries its own permissions, rate limits, optional budget, and an optional MCP scope. Keys are managed in Configuration → API Keys and are pushed to the connected gateway after creation. Use one key per application or environment so you can rotate, scope, and revoke them independently. The dashboard tracks status (active, inactive, expired, revoked), last-used time, request counts, and rate-limit usage for each key.

​
Options

The Create API Key dialog has two tabs: Basic for the key itself and MCP for MCP server scoping.

​
Basic tab

​
MCP tab

Scope the key to specific MCP servers and tools. Leave empty to allow access to every MCP server attached to the gateway. Add server names (e.g. filesystem, github) and tool identifiers (e.g. Filesystem/read_text_file) to restrict.

​
How to configure

Create API key dialog

Configuration → API Keys

1

Open Configuration → API Keys

Open Configuration → API Keys from the dashboard sidebar and click Create API Key.
2

Fill the Basic tab

Set a Key Name, choose an Expiration, set Requests/min and Tokens/min, and optionally a Budget with Alert Thresholds. Toggle Allowed Providers off for any provider this key should not reach.
3

(Optional) Restrict scope further

Expand Advanced Settings to set Allowed Models, IP Allowlist, and Metadata. Use the MCP tab to scope MCP servers and tools.
4

Create and copy the secret

Click Create. The full secret is shown once. Copy it into your secrets manager immediately.
The secret value is shown once at creation. If you lose it, you must rotate the key.
5

Verify it pushed to the gateway

The new key appears in the list with status Active. Run a test call from Playground with this key to confirm it reached the connected gateway.
API keys list

API keys list

​
Status, rotate, revoke

  • Active / Inactive — toggle a key on or off without rotating its secret.
  • Rotate issues a new secret. The old secret stops working immediately, so plan a deploy window for any client that uses it.
  • Revoke disables the key permanently and clears its in-flight quota.
Every status change, rotation, and revocation is recorded in the Audit log.
  • Providers — connect the upstream LLM providers a key can call.
  • Models — control which provider models are enabled.
  • Security — guardrail and MCP policies enforced for every key.
  • Notifications — subscribe to quota.threshold and quota.exceeded events.