Skip to main content

​
Overview

Management Keys are only available to workspace admins. The Management Keys page is not visible to non-admin members.
Management Keys are workspace-scoped tokens for authenticating workspace administration operations. They can manage API keys, Budgets, Projects, and Smart Routers.
Management Keys cannot be used to query models or agents. Use a standard API Key for inference and product endpoints.

​
Use cases

  • Automating workspace provisioning via the API.
  • Delegating API key rotation to a deployment pipeline without granting full admin access.
  • Letting a billing automation script read and update Budgets without exposing API key management.

​
Workspace administration endpoints

Standard API keys are project-scoped. Use a Management Key for these workspace administration endpoints: Notifiers are intentionally not listed here: their routes are project-scoped and do not require a Management Key. Project-scoped API keys can access the Notifiers API for their selected project.

​
View Management Keys

Navigate to Settings → Organization → Management Keys to view all keys in the workspace.
Management Keys list with columns for Created date, Name, Status, Permissions, and Created by.

The Management Keys list showing key name, status, permission mode, and creator.

Click any row to open the edit panel and update the key’s name, permissions, or expiration date. Hover a row and click for additional options:
  • Edit: open the edit panel to update the key’s name, permissions, or expiration date.
  • Duplicate: create a new key with the same permissions.
  • Delete: permanently remove the key from the workspace.

​
Create a Management Key

1

Open the creation panel

Navigate to Settings → Organization → Management Keys and click New key.
Create new key dialog showing Name field, Permissions toggle with All, Restricted, and Read only options, API keys and Budgets capability rows, and an Expiration date field.

The Create new key dialog with fields for name, permissions, per-capability access, and expiration date.

2

Enter a name

Enter a Name for the key (required, max 128 characters).
3

Set permissions

Select a Permissions mode, default is All. See Permission modes below.
4

Set expiration (optional)

Set an Expiration date if the key should stop authenticating after a certain date.
5

Create and copy the key

Click Create key. A Save your key panel appears showing the token.
The token is only shown once. Store it securely before closing this panel. It cannot be retrieved afterwards.

​
Permission modes

​
Capabilities

Management Keys are not available through MCP. Use the REST API to manage keys programmatically. See Manage keys programmatically for the key lifecycle, permission model, and SDK examples.