> ## Documentation Index
> Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure API Key Access Permissions for Workspaces

## Overview

API Key Management in the AI Gateway enables Organisation administrators to control how workspace managers and members interact with API keys within their workspaces. This feature offers granular control over who can view and manage different types of API keys, providing enhanced security and appropriate access levels across your organisation.

## Accessing API Key Management Permissions

1. Navigate to **Admin Settings** in Strata Cloud Manager
2. Select the **Security** tab from the left sidebar
3. Locate the **API Key Management** section

## Permission Settings

The API Key Management section provides four distinct permission options:

| Permission                           | Description                                                                                                                                                                                                  |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **View Keys (Workspace Managers)**   | Enable workspace managers to view both user API keys and service API keys within their workspace. Keys are limited to those created by workspace administrators.                                             |
| **Manage Keys (Workspace Managers)** | Allow workspace managers to create, update, and delete both user API keys and service API keys within their workspace. Managers can also create API keys on behalf of other users by specifying a `user_id`. |
| **View Keys (Workspace Members)**    | Enable workspace members to view user API keys only. Members can only see keys created for them by workspace managers or administrators.                                                                     |
| **Manage Keys (Workspace Members)**  | Allow workspace members to create, update, and delete user API keys only. Members can only manage keys created for them by workspace managers or administrators.                                             |

## Understanding API Key Types

**Note**: Service API keys provide system-level access and are distinct from user API keys which grant individual user access.

* **Service API Keys**: Used for automated processes, integrations, and system-level operations. These keys typically have broader permissions and are not tied to individual users.
* **User API Keys**: Associated with specific users and provide individualized access to the AI Gateway resources. These keys are generally more limited in scope and tied to the permissions of the specific user.

## Related Features

<Card title="Access Control Management" href="/docs/aigw/product/enterprise-offering/access-control-management">
  Learn about the AI Gateway's comprehensive access control features including user roles and organisation hierarchy
</Card>

<Card title="API Keys (AuthN and AuthZ)" href="/docs/aigw/product/enterprise-offering/org-management/api-keys-authn-and-authz">
  Understand the difference between Admin and Workspace API Keys in the AI Gateway
</Card>


## Related topics

- [Configure Prompt Access Permissions for Workspaces](/docs/aigw/product/administration/configure-prompt-access-permissions.md)
- [Configure Analytics Access Permissions for Workspaces](/docs/aigw/product/administration/configure-analytics-access-permissions.md)
- [Configure Guardrail Access Permissions for Workspaces](/docs/aigw/product/administration/configure-guardrail-access-permissions.md)
- [Configure Logs Access Permissions for Workspace](/docs/aigw/product/administration/configure-logs-access-permissions-in-workspace.md)
- [Configure Integration Access Permissions for Workspaces](/docs/aigw/product/administration/configure-integration-access-permissions.md)