Skip to main content

​
Overview

Management Keys are only available to workspace admins. The Management Keys page is not visible to non-admin members.
Management Keys are workspace-scoped tokens for authenticating workspace administration operations. Each key grants read or write access to every capability in Capabilities.
Management Keys cannot be used to query models or agents. Use a standard API Key for inference and product endpoints.

​
Use cases

  • Automating workspace provisioning via the API.
  • Delegating API key rotation to a deployment pipeline without granting full admin access.
  • Letting a billing automation script read and update Budgets without exposing API key management.

​
Workspace administration endpoints

API keys cannot administer API keys or Budgets, so those two families need a Management Key. Project and Smart Router management follows the key’s scope: an all-projects key can create, update, and delete them, a single-project key cannot.

​
View Management Keys

Open Management Keys in the Settings sidebar, under Organization, to view all keys in the workspace.
Management Keys list with columns for Created date, Name, Status, Permissions, and Created by.

The Management Keys list showing key name, status, permission mode, and creator.

Click any row to open the edit panel and update the key’s name, permissions, or expiration date. Hover a row and click for additional options:
  • Edit: open the edit panel to update the key’s name, permissions, or expiration date.
  • Duplicate: create a new key with the same permissions.
  • Delete: permanently remove the key from the workspace.

​
Create a Management Key

1

Open the creation panel

In Settings → Organization, open Management Keys and click Key.
Create new key dialog showing Name field, Permissions toggle with All, Restricted, and Read only options, API keys and Budgets capability rows, and an Expiration date field.

The Create new key panel with fields for name, permissions, and expiration date.

2

Enter a name

Enter a Name for the key (required, max 128 characters).
3

Set permissions

Select a Permissions mode, default is All. See Permission modes below.
4

Set expiration (optional)

Set an Expiration date if the key should stop authenticating after a certain date.
5

Create and copy the key

Click Create key. A Save your key panel appears showing the token.
The token is only shown once. Store it securely before closing this panel. It cannot be retrieved afterwards.

​
Permission modes

​
Capabilities

The Restricted mode shows one row per capability. None grants no access to that capability, Read lists and views its resources, and Write also creates, updates, and deletes them. A ✗ marks a level the picker omits for that capability, which then takes only None or Read.
Management Keys are not available through MCP. Use the REST API to manage keys programmatically. See Manage keys programmatically for the key lifecycle, permission model, and SDK examples.