API Keys (AuthN and AuthZ)

API Keys

The AI Gateway uses two types of API keys to manage access to resources and operations: Admin API Keys and Workspace API Keys. These keys play crucial roles in authenticating and authorizing various operations within your organisation and workspaces.

Admin API Keys

Admin API Keys operate at the organisation level and provide broad access across all workspaces within an organisation. Key features of Admin API Keys:

Created and managed by organisation owners and admins
Provide access to organisation-wide operations
Can perform actions across all workspaces in the organisation
Used for administrative tasks and integrations that require broad access
When making updates to entities, can specify a workspace_id to target specific workspaces

Admin API Keys should be carefully managed and their use should be limited to necessary administrative operations due to their broad scope of access.

Admin API Key Permission Scopes

Organisation Management

Scope	Description
`organisation_users.create`	Create new users in the organisation
`organisation_users.read`	View organisation user details
`organisation_users.update`	Modify organisation user settings
`organisation_users.delete`	Remove users from the organisation
`organisation_users.list`	List all organisation users
`organisation_service_api_keys.create`	Create new organisation service API keys
`organisation_service_api_keys.update`	Modify organisation service API keys
`organisation_service_api_keys.read`	View organisation service API key details
`organisation_service_api_keys.delete`	Delete organisation service API keys
`organisation_service_api_keys.list`	List all organisation service API keys
`organisation_service_api_keys.rotate`	Regenerate organisation service API keys
`organisation_settings.read`	View organisation settings, defaults, workspace overrides, and properties
`organisation_settings.update`	Modify organisation settings, defaults, workspace overrides, and properties
`organisation_guardrails.create`	Create organisation-level guardrails
`organisation_guardrails.read`	View organisation guardrail details
`organisation_guardrails.update`	Modify organisation guardrails
`organisation_guardrails.delete`	Remove organisation guardrails
`organisation_guardrails.list`	List organisation guardrails
`organisation_exclusions.update`	Exempt workspaces from organisation-level guardrails
`organisation_exclusions.list`	List workspaces exempted from organisation-level guardrails
`audit_logs.list`	Access system-wide audit logs
`plugins.create`	Create plugins
`plugins.update`	Update plugins
`plugins.list`	List plugins
`deployments.create`	Create new deployments
`deployments.read`	View deployment details
`deployments.update`	Modify deployment settings
`deployments.delete`	Remove deployments
`deployments.list`	List deployments
`secret_references.create`	Create new secret references
`secret_references.read`	View secret reference details
`secret_references.update`	Modify secret references
`secret_references.delete`	Delete secret references
`secret_references.list`	List secret references

Workspace Management

Scope	Description
`workspaces.create`	Create new workspaces
`workspaces.read`	View workspace details
`workspaces.update`	Modify workspace settings
`workspaces.delete`	Delete workspaces
`workspaces.list`	List all workspaces
`workspace_service_api_keys.create`	Create new workspace service API keys
`workspace_service_api_keys.update`	Modify workspace service API keys
`workspace_service_api_keys.read`	View workspace service API key details
`workspace_service_api_keys.delete`	Delete workspace service API keys
`workspace_service_api_keys.list`	List all workspace service API keys
`workspace_service_api_keys.rotate`	Regenerate workspace service API keys
`workspace_user_api_keys.create`	Create new workspace user API keys
`workspace_user_api_keys.update`	Modify workspace user API keys
`workspace_user_api_keys.read`	View workspace user API key details
`workspace_user_api_keys.delete`	Delete workspace user API keys
`workspace_user_api_keys.list`	List all workspace user API keys
`workspace_user_api_keys.rotate`	Regenerate workspace user API keys
`workspace_users.create`	Create new workspace users
`workspace_users.read`	View workspace user details
`workspace_users.update`	Update workspace user settings
`workspace_users.delete`	Remove users from workspace
`workspace_users.list`	List workspace users

Resource Management

Scope	Description
`prompts.create`	Create new prompt templates
`prompts.read`	View prompt template details
`prompts.update`	Modify existing prompt templates
`prompts.delete`	Delete prompt templates
`prompts.list`	List available prompt templates
`prompts.publish`	Publish prompt templates
`configs.create`	Create new configurations
`configs.update`	Update existing configurations
`configs.delete`	Delete configurations
`configs.read`	View configuration details
`configs.list`	List available configurations
`guardrails.create`	Create new guardrails
`guardrails.read`	View guardrail details
`guardrails.update`	Modify existing guardrails
`guardrails.delete`	Delete guardrails
`guardrails.list`	List available guardrails
`virtual_keys.create`	Create new virtual keys
`virtual_keys.read`	View virtual key details
`virtual_keys.update`	Modify existing virtual keys
`virtual_keys.delete`	Delete virtual keys
`virtual_keys.list`	List available virtual keys
`virtual_keys.duplicate`	Duplicate virtual keys
`virtual_keys.copy`	Copy virtual keys
`providers.create`	Create new providers
`providers.read`	View provider details
`providers.update`	Update existing providers
`providers.delete`	Delete providers
`providers.list`	List available providers
`policies.create`	Create policies
`policies.read`	View policy details
`policies.update`	Update policies
`policies.delete`	Delete policies
`policies.list`	List policies

Integrations

Scope	Description
`organisation_integrations.create`	Create organisation-level integrations
`organisation_integrations.read`	View organisation integration details
`organisation_integrations.update`	Update organisation integrations
`organisation_integrations.delete`	Delete organisation integrations
`organisation_integrations.list`	List organisation integrations
`organisation_mcp_integrations.create`	Create organisation MCP integrations
`organisation_mcp_integrations.read`	View organisation MCP integration details
`organisation_mcp_integrations.update`	Update organisation MCP integrations
`organisation_mcp_integrations.delete`	Delete organisation MCP integrations
`organisation_mcp_integrations.list`	List organisation MCP integrations
`organisation_agent_integrations.create`	Create organisation agent integrations
`organisation_agent_integrations.read`	View organisation agent integration details
`organisation_agent_integrations.update`	Update organisation agent integrations
`organisation_agent_integrations.delete`	Delete organisation agent integrations
`organisation_agent_integrations.list`	List organisation agent integrations
`workspace_integrations.create`	Create workspace integrations
`workspace_integrations.read`	View workspace integration details
`workspace_integrations.update`	Update workspace integrations
`workspace_integrations.delete`	Delete workspace integrations
`workspace_integrations.list`	List workspace integrations
`workspace_mcp_integrations.create`	Create workspace MCP integrations
`workspace_mcp_integrations.read`	View workspace MCP integration details
`workspace_mcp_integrations.update`	Update workspace MCP integrations
`workspace_mcp_integrations.delete`	Delete workspace MCP integrations
`workspace_mcp_integrations.list`	List workspace MCP integrations
`workspace_agent_integrations.create`	Create workspace agent integrations
`workspace_agent_integrations.read`	View workspace agent integration details
`workspace_agent_integrations.update`	Update workspace agent integrations
`workspace_agent_integrations.delete`	Delete workspace agent integrations
`workspace_agent_integrations.list`	List workspace agent integrations

AI & Agent Gateway

Scope	Description
`agent_servers.create`	Create agent servers
`agent_servers.read`	View agent server details
`agent_servers.update`	Update agent servers
`agent_servers.delete`	Delete agent servers
`agent_servers.list`	List agent servers
`mcp_servers.create`	Create MCP servers
`mcp_servers.read`	View MCP server details
`mcp_servers.update`	Update MCP servers
`mcp_servers.delete`	Delete MCP servers
`mcp_servers.list`	List MCP servers

Analytics and Logs

Scope	Description
`analytics.view`	Access analytics data
`logs.export`	Export logs to external systems
`logs.list`	List available logs
`logs.view`	View log details

Workspace API Keys

Workspace API Keys are scoped to a specific workspace and are used for operations within that workspace only. There are two types — Service API Keys and User API Keys — which share most scopes. The only difference is that Service API Keys can also manage other API keys within the workspace; User API Keys cannot.

Workspace Service API Keys

Used for automated processes, backend integrations, and CI pipelines. In addition to all operational scopes, service keys can create, update, rotate, and delete other workspace API keys.

Key Management

Scope	Description
`workspace_service_api_keys.create`	Create new workspace service API keys
`workspace_service_api_keys.read`	View workspace service API key details
`workspace_service_api_keys.update`	Modify workspace service API keys
`workspace_service_api_keys.delete`	Delete workspace service API keys
`workspace_service_api_keys.list`	List all workspace service API keys
`workspace_service_api_keys.rotate`	Regenerate workspace service API keys
`workspace_user_api_keys.create`	Create new workspace user API keys
`workspace_user_api_keys.read`	View workspace user API key details
`workspace_user_api_keys.update`	Modify workspace user API keys
`workspace_user_api_keys.delete`	Delete workspace user API keys
`workspace_user_api_keys.list`	List all workspace user API keys
`workspace_user_api_keys.rotate`	Regenerate workspace user API keys

Workspace Management

Scope	Description
`workspaces.read`	View workspace details
`workspaces.update`	Modify workspace settings
`workspaces.list`	List available workspaces
`workspace_users.create`	Create new workspace users
`workspace_users.read`	View workspace user details
`workspace_users.update`	Update workspace user settings
`workspace_users.delete`	Remove users from workspace
`workspace_users.list`	List workspace users

LLM Operations

Scope	Description
`completions.write`	Create and manage completions (includes /chat/completions, /completions, /images, /audio)
`prompts.create`	Create new prompt templates
`prompts.read`	View prompt template details
`prompts.update`	Modify existing prompt templates
`prompts.delete`	Delete prompt templates
`prompts.list`	List available prompt templates
`prompts.publish`	Publish prompt templates
`prompts.render`	Render prompt templates

MCP Gateway

Scope	Description
`mcp.invoke`	Call MCP gateway methods
`mcp_servers.create`	Create MCP servers
`mcp_servers.read`	View MCP server details
`mcp_servers.update`	Update MCP servers
`mcp_servers.delete`	Delete MCP servers
`mcp_servers.list`	List MCP servers
`workspace_mcp_integrations.create`	Create workspace MCP integrations
`workspace_mcp_integrations.read`	View workspace MCP integration details
`workspace_mcp_integrations.update`	Update workspace MCP integrations
`workspace_mcp_integrations.delete`	Delete workspace MCP integrations
`workspace_mcp_integrations.list`	List workspace MCP integrations
`organisation_mcp_integrations.list`	List organisation MCP integrations

Agent Gateway

Scope	Description
`agents.invoke`	Invoke agents
`agent_servers.create`	Create agent servers
`agent_servers.read`	View agent server details
`agent_servers.update`	Update agent servers
`agent_servers.delete`	Delete agent servers
`agent_servers.list`	List agent servers
`workspace_agent_integrations.create`	Create workspace agent integrations
`workspace_agent_integrations.read`	View workspace agent integration details
`workspace_agent_integrations.update`	Update workspace agent integrations
`workspace_agent_integrations.delete`	Delete workspace agent integrations
`workspace_agent_integrations.list`	List workspace agent integrations
`organisation_agent_integrations.list`	List organisation agent integrations

Resources

Scope	Description
`configs.create`	Create new configurations
`configs.update`	Update existing configurations
`configs.delete`	Delete configurations
`configs.read`	View configuration details
`configs.list`	List available configurations
`guardrails.create`	Create new guardrails
`guardrails.read`	View guardrail details
`guardrails.update`	Modify existing guardrails
`guardrails.delete`	Delete guardrails
`guardrails.list`	List available guardrails
`guardrails.invoke`	Invoke guardrails directly
`virtual_keys.create`	Create new virtual keys
`virtual_keys.read`	View virtual key details
`virtual_keys.update`	Modify existing virtual keys
`virtual_keys.delete`	Delete virtual keys
`virtual_keys.list`	List available virtual keys
`virtual_keys.duplicate`	Duplicate virtual keys
`virtual_keys.copy`	Copy virtual keys
`providers.create`	Create new providers
`providers.read`	View provider details
`providers.update`	Update existing providers
`providers.delete`	Delete providers
`providers.list`	List available providers
`policies.create`	Create policies
`policies.read`	View policy details
`policies.update`	Update policies
`policies.delete`	Delete policies
`policies.list`	List policies

Integrations

Scope	Description
`workspace_integrations.create`	Create workspace integrations
`workspace_integrations.read`	View workspace integration details
`workspace_integrations.update`	Update workspace integrations
`workspace_integrations.delete`	Delete workspace integrations
`workspace_integrations.list`	List workspace integrations
`organisation_integrations.list`	List organisation integrations

Analytics and Logs

Scope	Description
`analytics.view`	Access analytics data
`logs.export`	Export logs to external systems
`logs.list`	List available logs
`logs.view`	View log details
`logs.write`	Create and modify logs

Workspace User API Keys

Associated with individual users within a workspace. Identical in scope to service keys except they cannot manage other API keys — use these for personal access and user-level integrations.

Workspace Management

Scope	Description
`workspaces.read`	View workspace details
`workspaces.update`	Modify workspace settings
`workspaces.list`	List available workspaces
`workspace_users.create`	Create new workspace users
`workspace_users.read`	View workspace user details
`workspace_users.update`	Update workspace user settings
`workspace_users.delete`	Remove users from workspace
`workspace_users.list`	List workspace users

LLM Operations

Scope	Description
`completions.write`	Create and manage completions (includes /chat/completions, /completions, /images, /audio)
`prompts.create`	Create new prompt templates
`prompts.read`	View prompt template details
`prompts.update`	Modify existing prompt templates
`prompts.delete`	Delete prompt templates
`prompts.list`	List available prompt templates
`prompts.publish`	Publish prompt templates
`prompts.render`	Render prompt templates

MCP Gateway

Scope	Description
`mcp.invoke`	Call MCP gateway methods
`mcp_servers.create`	Create MCP servers
`mcp_servers.read`	View MCP server details
`mcp_servers.update`	Update MCP servers
`mcp_servers.delete`	Delete MCP servers
`mcp_servers.list`	List MCP servers
`workspace_mcp_integrations.create`	Create workspace MCP integrations
`workspace_mcp_integrations.read`	View workspace MCP integration details
`workspace_mcp_integrations.update`	Update workspace MCP integrations
`workspace_mcp_integrations.delete`	Delete workspace MCP integrations
`workspace_mcp_integrations.list`	List workspace MCP integrations
`organisation_mcp_integrations.list`	List organisation MCP integrations

Agent Gateway

Scope	Description
`agents.invoke`	Invoke agents
`agent_servers.create`	Create agent servers
`agent_servers.read`	View agent server details
`agent_servers.update`	Update agent servers
`agent_servers.delete`	Delete agent servers
`agent_servers.list`	List agent servers
`workspace_agent_integrations.create`	Create workspace agent integrations
`workspace_agent_integrations.read`	View workspace agent integration details
`workspace_agent_integrations.update`	Update workspace agent integrations
`workspace_agent_integrations.delete`	Delete workspace agent integrations
`workspace_agent_integrations.list`	List workspace agent integrations
`organisation_agent_integrations.list`	List organisation agent integrations

Resources

Scope	Description
`configs.create`	Create new configurations
`configs.update`	Update existing configurations
`configs.delete`	Delete configurations
`configs.read`	View configuration details
`configs.list`	List available configurations
`guardrails.create`	Create new guardrails
`guardrails.read`	View guardrail details
`guardrails.update`	Modify existing guardrails
`guardrails.delete`	Delete guardrails
`guardrails.list`	List available guardrails
`guardrails.invoke`	Invoke guardrails directly
`virtual_keys.create`	Create new virtual keys
`virtual_keys.read`	View virtual key details
`virtual_keys.update`	Modify existing virtual keys
`virtual_keys.delete`	Delete virtual keys
`virtual_keys.list`	List available virtual keys
`virtual_keys.duplicate`	Duplicate virtual keys
`virtual_keys.copy`	Copy virtual keys
`providers.create`	Create new providers
`providers.read`	View provider details
`providers.update`	Update existing providers
`providers.delete`	Delete providers
`providers.list`	List available providers
`policies.create`	Create policies
`policies.read`	View policy details
`policies.update`	Update policies
`policies.delete`	Delete policies
`policies.list`	List policies

Integrations

Scope	Description
`workspace_integrations.create`	Create workspace integrations
`workspace_integrations.read`	View workspace integration details
`workspace_integrations.update`	Update workspace integrations
`workspace_integrations.delete`	Delete workspace integrations
`workspace_integrations.list`	List workspace integrations
`organisation_integrations.list`	List organisation integrations

Analytics and Logs

Scope	Description
`analytics.view`	Access analytics data
`logs.export`	Export logs to external systems
`logs.list`	List available logs
`logs.view`	View log details
`logs.write`	Create and modify logs

Using API Key Scopes

When creating or updating API keys, you can define specific permission scopes based on your security requirements: Both types of API keys play important roles in the AI Gateway’s security model, enabling secure and efficient access to resources while maintaining proper separation of concerns between organisation-wide administration and workspace-specific operations.

Introduction

Product

API Keys (AuthN and AuthZ)

API Keys

Admin API Keys

Admin API Key Permission Scopes

Workspace API Keys

Workspace Service API Keys

Workspace User API Keys

Using API Key Scopes

Organisations

Workspaces

User Roles & Permissions

​API Keys

​Admin API Keys

​Admin API Key Permission Scopes

​Workspace API Keys

​Workspace Service API Keys

​Workspace User API Keys

​Using API Key Scopes

​Related Topics

Organisations

Workspaces

User Roles & Permissions

API Keys

Admin API Keys

Admin API Key Permission Scopes

Workspace API Keys

Workspace Service API Keys

Workspace User API Keys

Using API Key Scopes

Related Topics