> ## Documentation Index
> Fetch the complete documentation index at: https://docs.portkey.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys (AuthN and AuthZ)

> Discover how Admin and Workspace API Keys are used to manage access and operations in Portkey.

## API Keys

Portkey uses two types of API keys to manage access to resources and operations: **Admin API Keys** and **Workspace API Keys**. These keys play crucial roles in authenticating and authorizing various operations within your [organization](/product/enterprise-offering/org-management/organizations) and [workspaces](/api-reference/admin-api/control-plane/workspaces/create-workspace).

### Admin API Keys

Admin API Keys operate at the organization level and provide broad access across all workspaces within an organization.

Key features of Admin API Keys:

* Created and managed by organization owners and admins
* Provide access to organization-wide operations
* Can perform actions across all workspaces in the organization
* Used for administrative tasks and integrations that require broad access
* When making updates to entities, can specify a workspace\_id to target specific workspaces

Admin API Keys should be carefully managed and their use should be limited to necessary administrative operations due to their broad scope of access.

#### Admin API Key Permission Scopes

<AccordionGroup>
  <Accordion title="Organization Management" icon="building">
    | Scope                                  | Description                               |
    | -------------------------------------- | ----------------------------------------- |
    | `organisation_users.create`            | Create new users in the organization      |
    | `organisation_users.read`              | View organization user details            |
    | `organisation_users.update`            | Modify organization user settings         |
    | `organisation_users.delete`            | Remove users from the organization        |
    | `organisation_users.list`              | List all organization users               |
    | `organisation_service_api_keys.create` | Create new organization service API keys  |
    | `organisation_service_api_keys.update` | Modify organization service API keys      |
    | `organisation_service_api_keys.read`   | View organization service API key details |
    | `organisation_service_api_keys.delete` | Delete organization service API keys      |
    | `organisation_service_api_keys.list`   | List all organization service API keys    |
    | `organisation_service_api_keys.rotate` | Regenerate organization service API keys  |
    | `audit_logs.list`                      | Access system-wide audit logs             |
    | `plugins.create`                       | Create plugins                            |
    | `plugins.update`                       | Update plugins                            |
    | `plugins.list`                         | List plugins                              |
    | `deployments.create`                   | Create new deployments                    |
    | `deployments.read`                     | View deployment details                   |
    | `deployments.update`                   | Modify deployment settings                |
    | `deployments.delete`                   | Remove deployments                        |
    | `deployments.list`                     | List deployments                          |
    | `secret_references.create`             | Create new secret references              |
    | `secret_references.read`               | View secret reference details             |
    | `secret_references.update`             | Modify secret references                  |
    | `secret_references.delete`             | Delete secret references                  |
    | `secret_references.list`               | List secret references                    |
  </Accordion>

  <Accordion title="Workspace Management" icon="folder-tree">
    | Scope                               | Description                            |
    | ----------------------------------- | -------------------------------------- |
    | `workspaces.create`                 | Create new workspaces                  |
    | `workspaces.read`                   | View workspace details                 |
    | `workspaces.update`                 | Modify workspace settings              |
    | `workspaces.delete`                 | Delete workspaces                      |
    | `workspaces.list`                   | List all workspaces                    |
    | `workspace_service_api_keys.create` | Create new workspace service API keys  |
    | `workspace_service_api_keys.update` | Modify workspace service API keys      |
    | `workspace_service_api_keys.read`   | View workspace service API key details |
    | `workspace_service_api_keys.delete` | Delete workspace service API keys      |
    | `workspace_service_api_keys.list`   | List all workspace service API keys    |
    | `workspace_service_api_keys.rotate` | Regenerate workspace service API keys  |
    | `workspace_user_api_keys.create`    | Create new workspace user API keys     |
    | `workspace_user_api_keys.update`    | Modify workspace user API keys         |
    | `workspace_user_api_keys.read`      | View workspace user API key details    |
    | `workspace_user_api_keys.delete`    | Delete workspace user API keys         |
    | `workspace_user_api_keys.list`      | List all workspace user API keys       |
    | `workspace_user_api_keys.rotate`    | Regenerate workspace user API keys     |
    | `workspace_users.create`            | Create new workspace users             |
    | `workspace_users.read`              | View workspace user details            |
    | `workspace_users.update`            | Update workspace user settings         |
    | `workspace_users.delete`            | Remove users from workspace            |
    | `workspace_users.list`              | List workspace users                   |
  </Accordion>

  <Accordion title="Resource Management" icon="screwdriver-wrench">
    | Scope                    | Description                      |
    | ------------------------ | -------------------------------- |
    | `prompts.create`         | Create new prompt templates      |
    | `prompts.read`           | View prompt template details     |
    | `prompts.update`         | Modify existing prompt templates |
    | `prompts.delete`         | Delete prompt templates          |
    | `prompts.list`           | List available prompt templates  |
    | `prompts.publish`        | Publish prompt templates         |
    | `configs.create`         | Create new configurations        |
    | `configs.update`         | Update existing configurations   |
    | `configs.delete`         | Delete configurations            |
    | `configs.read`           | View configuration details       |
    | `configs.list`           | List available configurations    |
    | `guardrails.create`      | Create new guardrails            |
    | `guardrails.read`        | View guardrail details           |
    | `guardrails.update`      | Modify existing guardrails       |
    | `guardrails.delete`      | Delete guardrails                |
    | `guardrails.list`        | List available guardrails        |
    | `virtual_keys.create`    | Create new virtual keys          |
    | `virtual_keys.read`      | View virtual key details         |
    | `virtual_keys.update`    | Modify existing virtual keys     |
    | `virtual_keys.delete`    | Delete virtual keys              |
    | `virtual_keys.list`      | List available virtual keys      |
    | `virtual_keys.duplicate` | Duplicate virtual keys           |
    | `virtual_keys.copy`      | Copy virtual keys                |
    | `providers.create`       | Create new providers             |
    | `providers.read`         | View provider details            |
    | `providers.update`       | Update existing providers        |
    | `providers.delete`       | Delete providers                 |
    | `providers.list`         | List available providers         |
    | `policies.create`        | Create policies                  |
    | `policies.read`          | View policy details              |
    | `policies.update`        | Update policies                  |
    | `policies.delete`        | Delete policies                  |
    | `policies.list`          | List policies                    |
  </Accordion>

  <Accordion title="Integrations" icon="plug">
    | Scope                                    | Description                                 |
    | ---------------------------------------- | ------------------------------------------- |
    | `organisation_integrations.create`       | Create organisation-level integrations      |
    | `organisation_integrations.read`         | View organisation integration details       |
    | `organisation_integrations.update`       | Update organisation integrations            |
    | `organisation_integrations.delete`       | Delete organisation integrations            |
    | `organisation_integrations.list`         | List organisation integrations              |
    | `organisation_mcp_integrations.create`   | Create organisation MCP integrations        |
    | `organisation_mcp_integrations.read`     | View organisation MCP integration details   |
    | `organisation_mcp_integrations.update`   | Update organisation MCP integrations        |
    | `organisation_mcp_integrations.delete`   | Delete organisation MCP integrations        |
    | `organisation_mcp_integrations.list`     | List organisation MCP integrations          |
    | `organisation_agent_integrations.create` | Create organisation agent integrations      |
    | `organisation_agent_integrations.read`   | View organisation agent integration details |
    | `organisation_agent_integrations.update` | Update organisation agent integrations      |
    | `organisation_agent_integrations.delete` | Delete organisation agent integrations      |
    | `organisation_agent_integrations.list`   | List organisation agent integrations        |
    | `workspace_integrations.create`          | Create workspace integrations               |
    | `workspace_integrations.read`            | View workspace integration details          |
    | `workspace_integrations.update`          | Update workspace integrations               |
    | `workspace_integrations.delete`          | Delete workspace integrations               |
    | `workspace_integrations.list`            | List workspace integrations                 |
    | `workspace_mcp_integrations.create`      | Create workspace MCP integrations           |
    | `workspace_mcp_integrations.read`        | View workspace MCP integration details      |
    | `workspace_mcp_integrations.update`      | Update workspace MCP integrations           |
    | `workspace_mcp_integrations.delete`      | Delete workspace MCP integrations           |
    | `workspace_mcp_integrations.list`        | List workspace MCP integrations             |
    | `workspace_agent_integrations.create`    | Create workspace agent integrations         |
    | `workspace_agent_integrations.read`      | View workspace agent integration details    |
    | `workspace_agent_integrations.update`    | Update workspace agent integrations         |
    | `workspace_agent_integrations.delete`    | Delete workspace agent integrations         |
    | `workspace_agent_integrations.list`      | List workspace agent integrations           |
  </Accordion>

  <Accordion title="AI & Agent Gateway" icon="robot">
    | Scope                  | Description               |
    | ---------------------- | ------------------------- |
    | `agent_servers.create` | Create agent servers      |
    | `agent_servers.read`   | View agent server details |
    | `agent_servers.update` | Update agent servers      |
    | `agent_servers.delete` | Delete agent servers      |
    | `agent_servers.list`   | List agent servers        |
    | `mcp_servers.create`   | Create MCP servers        |
    | `mcp_servers.read`     | View MCP server details   |
    | `mcp_servers.update`   | Update MCP servers        |
    | `mcp_servers.delete`   | Delete MCP servers        |
    | `mcp_servers.list`     | List MCP servers          |
  </Accordion>

  <Accordion title="Analytics and Logs" icon="chart-line">
    | Scope            | Description                     |
    | ---------------- | ------------------------------- |
    | `analytics.view` | Access analytics data           |
    | `logs.export`    | Export logs to external systems |
    | `logs.list`      | List available logs             |
    | `logs.view`      | View log details                |
  </Accordion>
</AccordionGroup>

### Workspace API Keys

Workspace API Keys are scoped to a specific workspace and are used for operations within that workspace only. There are two types — Service API Keys and User API Keys — which share most scopes. The only difference is that Service API Keys can also manage other API keys within the workspace; User API Keys cannot.

#### Workspace Service API Keys

Used for automated processes, backend integrations, and CI pipelines. In addition to all operational scopes, service keys can create, update, rotate, and delete other workspace API keys.

<AccordionGroup>
  <Accordion title="Key Management" icon="key">
    | Scope                               | Description                            |
    | ----------------------------------- | -------------------------------------- |
    | `workspace_service_api_keys.create` | Create new workspace service API keys  |
    | `workspace_service_api_keys.read`   | View workspace service API key details |
    | `workspace_service_api_keys.update` | Modify workspace service API keys      |
    | `workspace_service_api_keys.delete` | Delete workspace service API keys      |
    | `workspace_service_api_keys.list`   | List all workspace service API keys    |
    | `workspace_service_api_keys.rotate` | Regenerate workspace service API keys  |
    | `workspace_user_api_keys.create`    | Create new workspace user API keys     |
    | `workspace_user_api_keys.read`      | View workspace user API key details    |
    | `workspace_user_api_keys.update`    | Modify workspace user API keys         |
    | `workspace_user_api_keys.delete`    | Delete workspace user API keys         |
    | `workspace_user_api_keys.list`      | List all workspace user API keys       |
    | `workspace_user_api_keys.rotate`    | Regenerate workspace user API keys     |
  </Accordion>

  <Accordion title="Workspace Management" icon="folder-tree">
    | Scope                    | Description                    |
    | ------------------------ | ------------------------------ |
    | `workspaces.read`        | View workspace details         |
    | `workspaces.update`      | Modify workspace settings      |
    | `workspaces.list`        | List available workspaces      |
    | `workspace_users.create` | Create new workspace users     |
    | `workspace_users.read`   | View workspace user details    |
    | `workspace_users.update` | Update workspace user settings |
    | `workspace_users.delete` | Remove users from workspace    |
    | `workspace_users.list`   | List workspace users           |
  </Accordion>

  <Accordion title="LLM Operations" icon="microchip">
    | Scope               | Description                                                                               |
    | ------------------- | ----------------------------------------------------------------------------------------- |
    | `completions.write` | Create and manage completions (includes /chat/completions, /completions, /images, /audio) |
    | `prompts.create`    | Create new prompt templates                                                               |
    | `prompts.read`      | View prompt template details                                                              |
    | `prompts.update`    | Modify existing prompt templates                                                          |
    | `prompts.delete`    | Delete prompt templates                                                                   |
    | `prompts.list`      | List available prompt templates                                                           |
    | `prompts.publish`   | Publish prompt templates                                                                  |
    | `prompts.render`    | Render prompt templates                                                                   |
  </Accordion>

  <Accordion title="MCP Gateway" icon="network-wired">
    | Scope                                | Description                            |
    | ------------------------------------ | -------------------------------------- |
    | `mcp.invoke`                         | Call MCP gateway methods               |
    | `mcp_servers.create`                 | Create MCP servers                     |
    | `mcp_servers.read`                   | View MCP server details                |
    | `mcp_servers.update`                 | Update MCP servers                     |
    | `mcp_servers.delete`                 | Delete MCP servers                     |
    | `mcp_servers.list`                   | List MCP servers                       |
    | `workspace_mcp_integrations.create`  | Create workspace MCP integrations      |
    | `workspace_mcp_integrations.read`    | View workspace MCP integration details |
    | `workspace_mcp_integrations.update`  | Update workspace MCP integrations      |
    | `workspace_mcp_integrations.delete`  | Delete workspace MCP integrations      |
    | `workspace_mcp_integrations.list`    | List workspace MCP integrations        |
    | `organisation_mcp_integrations.list` | List organisation MCP integrations     |
  </Accordion>

  <Accordion title="Agent Gateway" icon="robot">
    | Scope                                  | Description                              |
    | -------------------------------------- | ---------------------------------------- |
    | `agents.invoke`                        | Invoke agents                            |
    | `agent_servers.create`                 | Create agent servers                     |
    | `agent_servers.read`                   | View agent server details                |
    | `agent_servers.update`                 | Update agent servers                     |
    | `agent_servers.delete`                 | Delete agent servers                     |
    | `agent_servers.list`                   | List agent servers                       |
    | `workspace_agent_integrations.create`  | Create workspace agent integrations      |
    | `workspace_agent_integrations.read`    | View workspace agent integration details |
    | `workspace_agent_integrations.update`  | Update workspace agent integrations      |
    | `workspace_agent_integrations.delete`  | Delete workspace agent integrations      |
    | `workspace_agent_integrations.list`    | List workspace agent integrations        |
    | `organisation_agent_integrations.list` | List organisation agent integrations     |
  </Accordion>

  <Accordion title="Resources" icon="server">
    | Scope                    | Description                    |
    | ------------------------ | ------------------------------ |
    | `configs.create`         | Create new configurations      |
    | `configs.update`         | Update existing configurations |
    | `configs.delete`         | Delete configurations          |
    | `configs.read`           | View configuration details     |
    | `configs.list`           | List available configurations  |
    | `guardrails.create`      | Create new guardrails          |
    | `guardrails.read`        | View guardrail details         |
    | `guardrails.update`      | Modify existing guardrails     |
    | `guardrails.delete`      | Delete guardrails              |
    | `guardrails.list`        | List available guardrails      |
    | `guardrails.invoke`      | Invoke guardrails directly     |
    | `virtual_keys.create`    | Create new virtual keys        |
    | `virtual_keys.read`      | View virtual key details       |
    | `virtual_keys.update`    | Modify existing virtual keys   |
    | `virtual_keys.delete`    | Delete virtual keys            |
    | `virtual_keys.list`      | List available virtual keys    |
    | `virtual_keys.duplicate` | Duplicate virtual keys         |
    | `virtual_keys.copy`      | Copy virtual keys              |
    | `providers.create`       | Create new providers           |
    | `providers.read`         | View provider details          |
    | `providers.update`       | Update existing providers      |
    | `providers.delete`       | Delete providers               |
    | `providers.list`         | List available providers       |
    | `policies.create`        | Create policies                |
    | `policies.read`          | View policy details            |
    | `policies.update`        | Update policies                |
    | `policies.delete`        | Delete policies                |
    | `policies.list`          | List policies                  |
  </Accordion>

  <Accordion title="Integrations" icon="plug">
    | Scope                            | Description                        |
    | -------------------------------- | ---------------------------------- |
    | `workspace_integrations.create`  | Create workspace integrations      |
    | `workspace_integrations.read`    | View workspace integration details |
    | `workspace_integrations.update`  | Update workspace integrations      |
    | `workspace_integrations.delete`  | Delete workspace integrations      |
    | `workspace_integrations.list`    | List workspace integrations        |
    | `organisation_integrations.list` | List organisation integrations     |
  </Accordion>

  <Accordion title="Analytics and Logs" icon="chart-line">
    | Scope            | Description                     |
    | ---------------- | ------------------------------- |
    | `analytics.view` | Access analytics data           |
    | `logs.export`    | Export logs to external systems |
    | `logs.list`      | List available logs             |
    | `logs.view`      | View log details                |
    | `logs.write`     | Create and modify logs          |
  </Accordion>
</AccordionGroup>

#### Workspace User API Keys

Associated with individual users within a workspace. Identical in scope to service keys except they cannot manage other API keys — use these for personal access and user-level integrations.

<AccordionGroup>
  <Accordion title="Workspace Management" icon="folder-tree">
    | Scope                    | Description                    |
    | ------------------------ | ------------------------------ |
    | `workspaces.read`        | View workspace details         |
    | `workspaces.update`      | Modify workspace settings      |
    | `workspaces.list`        | List available workspaces      |
    | `workspace_users.create` | Create new workspace users     |
    | `workspace_users.read`   | View workspace user details    |
    | `workspace_users.update` | Update workspace user settings |
    | `workspace_users.delete` | Remove users from workspace    |
    | `workspace_users.list`   | List workspace users           |
  </Accordion>

  <Accordion title="LLM Operations" icon="microchip">
    | Scope               | Description                                                                               |
    | ------------------- | ----------------------------------------------------------------------------------------- |
    | `completions.write` | Create and manage completions (includes /chat/completions, /completions, /images, /audio) |
    | `prompts.create`    | Create new prompt templates                                                               |
    | `prompts.read`      | View prompt template details                                                              |
    | `prompts.update`    | Modify existing prompt templates                                                          |
    | `prompts.delete`    | Delete prompt templates                                                                   |
    | `prompts.list`      | List available prompt templates                                                           |
    | `prompts.publish`   | Publish prompt templates                                                                  |
    | `prompts.render`    | Render prompt templates                                                                   |
  </Accordion>

  <Accordion title="MCP Gateway" icon="network-wired">
    | Scope                                | Description                            |
    | ------------------------------------ | -------------------------------------- |
    | `mcp.invoke`                         | Call MCP gateway methods               |
    | `mcp_servers.create`                 | Create MCP servers                     |
    | `mcp_servers.read`                   | View MCP server details                |
    | `mcp_servers.update`                 | Update MCP servers                     |
    | `mcp_servers.delete`                 | Delete MCP servers                     |
    | `mcp_servers.list`                   | List MCP servers                       |
    | `workspace_mcp_integrations.create`  | Create workspace MCP integrations      |
    | `workspace_mcp_integrations.read`    | View workspace MCP integration details |
    | `workspace_mcp_integrations.update`  | Update workspace MCP integrations      |
    | `workspace_mcp_integrations.delete`  | Delete workspace MCP integrations      |
    | `workspace_mcp_integrations.list`    | List workspace MCP integrations        |
    | `organisation_mcp_integrations.list` | List organisation MCP integrations     |
  </Accordion>

  <Accordion title="Agent Gateway" icon="robot">
    | Scope                                  | Description                              |
    | -------------------------------------- | ---------------------------------------- |
    | `agents.invoke`                        | Invoke agents                            |
    | `agent_servers.create`                 | Create agent servers                     |
    | `agent_servers.read`                   | View agent server details                |
    | `agent_servers.update`                 | Update agent servers                     |
    | `agent_servers.delete`                 | Delete agent servers                     |
    | `agent_servers.list`                   | List agent servers                       |
    | `workspace_agent_integrations.create`  | Create workspace agent integrations      |
    | `workspace_agent_integrations.read`    | View workspace agent integration details |
    | `workspace_agent_integrations.update`  | Update workspace agent integrations      |
    | `workspace_agent_integrations.delete`  | Delete workspace agent integrations      |
    | `workspace_agent_integrations.list`    | List workspace agent integrations        |
    | `organisation_agent_integrations.list` | List organisation agent integrations     |
  </Accordion>

  <Accordion title="Resources" icon="server">
    | Scope                    | Description                    |
    | ------------------------ | ------------------------------ |
    | `configs.create`         | Create new configurations      |
    | `configs.update`         | Update existing configurations |
    | `configs.delete`         | Delete configurations          |
    | `configs.read`           | View configuration details     |
    | `configs.list`           | List available configurations  |
    | `guardrails.create`      | Create new guardrails          |
    | `guardrails.read`        | View guardrail details         |
    | `guardrails.update`      | Modify existing guardrails     |
    | `guardrails.delete`      | Delete guardrails              |
    | `guardrails.list`        | List available guardrails      |
    | `guardrails.invoke`      | Invoke guardrails directly     |
    | `virtual_keys.create`    | Create new virtual keys        |
    | `virtual_keys.read`      | View virtual key details       |
    | `virtual_keys.update`    | Modify existing virtual keys   |
    | `virtual_keys.delete`    | Delete virtual keys            |
    | `virtual_keys.list`      | List available virtual keys    |
    | `virtual_keys.duplicate` | Duplicate virtual keys         |
    | `virtual_keys.copy`      | Copy virtual keys              |
    | `providers.create`       | Create new providers           |
    | `providers.read`         | View provider details          |
    | `providers.update`       | Update existing providers      |
    | `providers.delete`       | Delete providers               |
    | `providers.list`         | List available providers       |
    | `policies.create`        | Create policies                |
    | `policies.read`          | View policy details            |
    | `policies.update`        | Update policies                |
    | `policies.delete`        | Delete policies                |
    | `policies.list`          | List policies                  |
  </Accordion>

  <Accordion title="Integrations" icon="plug">
    | Scope                            | Description                        |
    | -------------------------------- | ---------------------------------- |
    | `workspace_integrations.create`  | Create workspace integrations      |
    | `workspace_integrations.read`    | View workspace integration details |
    | `workspace_integrations.update`  | Update workspace integrations      |
    | `workspace_integrations.delete`  | Delete workspace integrations      |
    | `workspace_integrations.list`    | List workspace integrations        |
    | `organisation_integrations.list` | List organisation integrations     |
  </Accordion>

  <Accordion title="Analytics and Logs" icon="chart-line">
    | Scope            | Description                     |
    | ---------------- | ------------------------------- |
    | `analytics.view` | Access analytics data           |
    | `logs.export`    | Export logs to external systems |
    | `logs.list`      | List available logs             |
    | `logs.view`      | View log details                |
    | `logs.write`     | Create and modify logs          |
  </Accordion>
</AccordionGroup>

## Using API Key Scopes

When creating or updating API keys, you can define specific permission scopes based on your security requirements:

Both types of API keys play important roles in Portkey's security model, enabling secure and efficient access to resources while maintaining proper separation of concerns between organization-wide administration and workspace-specific operations.

### Related Topics

<Card title="Organizations" href="/product/enterprise-offering/org-management/organizations" />

<Card title="Workspaces" href="/api-reference/admin-api/control-plane/workspaces/create-workspace" />

<Card title="User Roles & Permissions" href="/product/enterprise-offering/org-management/user-roles-and-permissions" />