> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Management Keys

> Create workspace-scoped management keys in Orq.ai to authenticate admin operations on API keys, budgets, projects, and workspace settings.

## Overview

<Info>
  Management Keys are only available to workspace admins. The **Management Keys** page is not visible to non-admin members.
</Info>

**Management Keys** are workspace-scoped tokens for authenticating workspace administration operations. They can manage **API keys**, **Budgets**, **Projects**, **Smart Routers**, **Evaluators**, **Workspace models**, and **Workspace Settings**.

<Tip>
  Management Keys cannot be used to query models or agents. Use a standard [API Key](/ai-studio/organization/api-keys) for inference and product endpoints.
</Tip>

### Use cases

* Automating workspace provisioning via the API.
* Delegating API key rotation to a deployment pipeline without granting full admin access.
* Letting a billing automation script read and update Budgets without exposing API key management.

### Workspace administration endpoints

Standard API keys are project-scoped. Use a Management Key for these workspace administration endpoints:

| Endpoint family          | Management Key access                                                                                          |
| ------------------------ | -------------------------------------------------------------------------------------------------------------- |
| `/v2/api-keys*`          | List, retrieve, create, update, and delete API keys. `/v2/api-keys/capabilities` is public.                    |
| `/v2/budgets*`           | List, retrieve, create, update, reset, and delete Budgets.                                                     |
| `/v2/projects*`          | Manage Projects across the workspace. A project-scoped API key can only list or retrieve its selected Project. |
| `/v2/smart-routers*`     | List, retrieve, create, update, enable, disable, and delete Smart Routers.                                     |
| `/v2/evaluators*`        | List, retrieve, create, update, and delete Evaluators.                                                         |
| `/v2/workspace-settings` | Retrieve or update Workspace Settings according to the key capability.                                         |

Notifiers are intentionally not listed here: their routes are project-scoped and do not require a Management Key. Project-scoped API keys can access the Notifiers API for their selected project.

## View Management Keys

Navigate to **Settings** → **Organization** → **Management Keys** to view all keys in the workspace.

<Frame caption="The Management Keys list showing key name, status, permission mode, and creator.">
  <img src="https://mintcdn.com/orqai/K6sTaJb5h4tCQHNp/images/management-key-overview-411.png?fit=max&auto=format&n=K6sTaJb5h4tCQHNp&q=85&s=97564ebb62278b7db50badb166b3392c" alt="Management Keys list with columns for Created date, Name, Status, Permissions, and Created by." width="1446" height="721" data-path="images/management-key-overview-411.png" />
</Frame>

Click any row to open the edit panel and update the key's name, permissions, or expiration date. Hover a row and click <kbd><Icon icon="ellipsis" /></kbd> for additional options:

* <kbd><Icon icon="pencil" /> Edit</kbd>: open the edit panel to update the key's name, permissions, or expiration date.
* <kbd><Icon icon="copy" /> Duplicate</kbd>: create a new key with the same permissions.
* <kbd style={{ color: 'red' }}><Icon icon="trash" color="red" /> Delete</kbd>: permanently remove the key from the workspace.

## Create a Management Key

<Steps>
  <Step title="Open the creation panel">
    Navigate to **Settings** → **Organization** → **Management Keys** and click <kbd><Icon icon="plus" /> New key</kbd>.

    <Frame caption="The Create new key dialog with fields for name, permissions, per-capability access, and expiration date.">
      <img src="https://mintcdn.com/orqai/K6sTaJb5h4tCQHNp/images/management-key-create-411.png?fit=max&auto=format&n=K6sTaJb5h4tCQHNp&q=85&s=4fc647d11105b51d1f7ca5a273729b4c" alt="Create new key dialog showing Name field, Permissions toggle with All, Restricted, and Read only options, API keys and Budgets capability rows, and an Expiration date field." width="815" height="752" data-path="images/management-key-create-411.png" />
    </Frame>
  </Step>

  <Step title="Enter a name">
    Enter a **Name** for the key (required, max 128 characters).
  </Step>

  <Step title="Set permissions">
    Select a **Permissions** mode, default is All. See [Permission modes](#permission-modes) below.
  </Step>

  <Step title="Set expiration (optional)">
    Set an **Expiration** date if the key should stop authenticating after a certain date.
  </Step>

  <Step title="Create and copy the key">
    Click <kbd>Create key</kbd>. A **Save your key** panel appears showing the token.

    <Warning>
      The token is only shown once. Store it securely before closing this panel. It cannot be retrieved afterwards.
    </Warning>
  </Step>
</Steps>

### Permission modes

| Mode           | Description                                                                                        |
| -------------- | -------------------------------------------------------------------------------------------------- |
| **All**        | Full read and write access to all capabilities.                                                    |
| **Restricted** | Configure access per capability. Each capability can be set to None, Read, or Write independently. |
| **Read only**  | Read access to all capabilities.                                                                   |

### Capabilities

| Capability             | <Icon icon="shield-slash" /> None | <Icon icon="book-open" /> Read                                                                          | <Icon icon="pencil" /> Write                                                         |
| ---------------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| **API keys**           | No access.                        | List and view workspace **API keys**.                                                                   | List, view, create, update, revoke, and delete workspace **API keys**.               |
| **Budgets**            | No access.                        | List and view workspace **Budgets**.                                                                    | List, view, create, update, reset, and delete workspace **Budgets**.                 |
| **Projects**           | No access.                        | List and view workspace **Projects**.                                                                   | List, view, create, update, and delete workspace **Projects**.                       |
| **Smart Routers**      | No access.                        | List and view workspace **Smart Routers**.                                                              | List, view, create, update, enable, disable, and delete workspace **Smart Routers**. |
| **Evaluators**         | No access.                        | List and view workspace **Evaluators**.                                                                 | List, view, create, update, and delete workspace **Evaluators**.                     |
| **Workspace models**   | No access.                        | No list or view endpoints exist for workspace **models**; read access alone performs no API operations. | Enable and disable workspace **models** and manage their sharing.                    |
| **Workspace Settings** | No access.                        | View workspace settings.                                                                                | View and update workspace settings.                                                  |

<Note>
  Management Keys are not available through MCP. Use the REST API to manage keys programmatically. See [Manage keys programmatically](/ai-gateway/configuration/api-keys#manage-keys-programmatically) for the key lifecycle, permission model, and SDK examples.
</Note>