> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Management Keys | AI Gateway

> Create workspace-scoped management keys to authenticate workspace administration operations such as creating API keys and managing budgets in the AI Gateway.

## Overview

<Info>
  Management Keys are only available to workspace admins. The **Management Keys** page is not visible to non-admin members.
</Info>

**Management Keys** are workspace-scoped tokens for authenticating workspace administration operations. They can create, update, and revoke **API keys** and manage **Budgets**.

<Tip>
  Management Keys cannot be used to query models. Use a standard [API Key](/docs/ai-gateway/api-keys) for inference.
</Tip>

### Use cases

* Automating workspace provisioning via the API.
* Delegating API key rotation to a deployment pipeline without granting full admin access.
* Letting a billing automation script read and update Budgets without exposing API key management.

## View Management Keys

Navigate to **Settings** → **Organization** → **Management Keys** to view all keys in the workspace.

<Frame caption="The Management Keys list showing key name, status, permission mode, and creator.">
  <img src="https://mintcdn.com/orqai/K6sTaJb5h4tCQHNp/images/management-key-overview-411.png?fit=max&auto=format&n=K6sTaJb5h4tCQHNp&q=85&s=97564ebb62278b7db50badb166b3392c" alt="Management Keys list with columns for Created date, Name, Status, Permissions, and Created by." width="1446" height="721" data-path="images/management-key-overview-411.png" />
</Frame>

Click any row to open the edit panel and update the key's name, permissions, or expiration date. Hover a row and click <kbd><Icon icon="ellipsis" /></kbd> for additional options:

* <kbd><Icon icon="pencil" /> Edit</kbd>: open the edit panel to update the key's name, permissions, or expiration date.
* <kbd><Icon icon="copy" /> Duplicate</kbd>: create a new key with the same permissions.
* <kbd style={{ color: 'red' }}><Icon icon="trash" color="red" /> Delete</kbd>: permanently remove the key from the workspace.

## Create a Management Key

<Steps>
  <Step title="Open the creation panel">
    Navigate to **Settings** → **Organization** → **Management Keys** and click <kbd><Icon icon="plus" /> New key</kbd>.

    <Frame caption="The Create new key dialog with fields for name, permissions, per-capability access, and expiration date.">
      <img src="https://mintcdn.com/orqai/K6sTaJb5h4tCQHNp/images/management-key-create-411.png?fit=max&auto=format&n=K6sTaJb5h4tCQHNp&q=85&s=4fc647d11105b51d1f7ca5a273729b4c" alt="Create new key dialog showing Name field, Permissions toggle with All, Restricted, and Read only options, API keys and Budgets capability rows, and an Expiration date field." width="815" height="752" data-path="images/management-key-create-411.png" />
    </Frame>
  </Step>

  <Step title="Enter a name">
    Enter a **Name** for the key (required, max 128 characters).
  </Step>

  <Step title="Set permissions">
    Select a **Permissions** mode, default is All. See [Permission modes](#permission-modes) below.
  </Step>

  <Step title="Set expiration (optional)">
    Set an **Expiration** date if the key should stop authenticating after a certain date.
  </Step>

  <Step title="Create and copy the key">
    Click <kbd>Create key</kbd>. A **Save your key** panel appears showing the token.

    <Warning>
      The token is only shown once. Store it securely before closing this panel. It cannot be retrieved afterwards.
    </Warning>
  </Step>
</Steps>

### Permission modes

| Mode           | Description                                                                                        |
| -------------- | -------------------------------------------------------------------------------------------------- |
| **All**        | Full read and write access to all capabilities.                                                    |
| **Restricted** | Configure access per capability. Each capability can be set to None, Read, or Write independently. |
| **Read only**  | Read access to all capabilities.                                                                   |

### Capabilities

| Capability   | <Icon icon="shield-slash" /> None | <Icon icon="book-open" /> Read        | <Icon icon="pencil" /> Write                                   |
| ------------ | --------------------------------- | ------------------------------------- | -------------------------------------------------------------- |
| **API keys** | No access.                        | List and view workspace **API keys**. | List, view, create, update, and revoke workspace **API keys**. |
| **Budgets**  | No access.                        | List and view workspace **Budgets**.  | List, view, create, and update workspace **Budgets**.          |

<Note>
  Management Keys are not available through MCP. Use the REST API to manage keys programmatically.
</Note>