Orq MCP is live: Use natural language to interrogate traces, spot regressions, and experiment your way to optimal AI configurations. Available in Claude Desktop, Claude Code, Cursor, and more. Start now →
API Keys are secure tokens required to authenticate and make requests to the AI Gateway. Each key is scoped to a single project and carries a set of permissions that control what it can do. Multiple keys can be provisioned for different environments (production, staging, development), purposes, or team members, providing granular control and auditing of access.Two key types are available, chosen by the key’s owner.
Tied to a specific user account and project. Automatically revoked if the user is removed from the organization or project. Use user keys for personal use and local development.
Not tied to any individual user, with a lifecycle independent of user membership. Only workspace admins can create service account keys. Use service account keys for production systems, so access does not break when a team member leaves.
Navigate to the API Keys page in the AI Gateway and select Create API key.
Configure owner, name, project, permissions, spending limits, and expiration when creating an API key.
2
Choose an owner
Select You to create a User key, or Service account to create a key not tied to any individual user.
3
Set name and project
Enter a Name for the key and select the Project it will have access to.
4
Set permissions
Choose a permission preset. See Permissions below.
5
Set optional limits
Optionally cap spend and usage on the key:
Cost Limit (in USD): caps the total spend for requests made with this key.
Token Limit: caps the total number of tokens consumed.
Requests/Min: caps the number of requests within a rolling 60-second window.
Reset limit period: defines when the Cost and Token counters reset, allowing recurring budget allocations. Does not apply to Requests/Min, which always uses a 60-second window.
When any configured limit is reached, further requests using this key are rejected with a 429 Too Many Requests error.
6
Set expiration (optional)
Set an Expiration date if the key should automatically become inactive after a certain date.
7
Create and copy the key
Select Create API key. A Save your key dialog appears showing the token and its permissions summary.
The token is only shown once. Store it securely before closing this dialog. It cannot be retrieved afterwards.
API Keys list showing key name, status toggle, and action menu.
Select the menu on any key to access the following actions:
Edit: update the name, permissions, limits, or expiration date. The owner type cannot be changed after creation.
Duplicate: opens the creation panel pre-filled with the key’s current settings.
Overview: view current usage against the key’s cost, token, and rate limits.
Delete: permanently removes the key. This cannot be undone.
Use the status toggle on any row to temporarily disable a key. Disabled keys can be re-enabled at any time.
A Revoked status means the key belonged to a user who was removed from the organization or project, or it has been revoked manually. Revocation is permanent.
Workspaces created before AI Gateway API keys were introduced may have legacy keys. Legacy keys continue to work but do not support the cost, token, and rate limits or the granular per-resource permissions available on new keys.
Legacy API key shown in the AI Gateway API Keys list.
To get granular access controls, create a new API key and replace the legacy one:
Go to API Keys in the AI Gateway sidebar.
Click Create API Key and configure the required limits and permissions.
Update any integrations or environment variables to use the new key.
Disable or delete the legacy key once all consumers have switched.
