Skip to main content
Create a key from api keys in the console, then store it in your server environment. The full key is shown only once.
Authenticate model requests with:
The Anthropic SDK sends x-api-key automatically. Use an impossibl key there too; a provider key belongs in BYOK configuration.

​
A key belongs to a workspace

A key selects the workspace for usage, credits, and logs. Switching the console’s workspace does not move an existing key. Keys keep working when their creator leaves the workspace. Treat a key as a workspace credential, not a limited end-user token. API keys do not inherit the creator’s membership role or provide a per-key spending limit. Use separate keys for applications so you can identify and revoke them independently; use separate workspaces when you need separate balances.

​
Rotate a key

  1. Create a new key in the same workspace.
  2. Update the server secret and deploy your application.
  3. Confirm requests work with the new key, then revoke the old key.
Keep keys out of browser bundles, mobile apps, source control, and shared logs. Route client requests through your own authenticated server. If a key is exposed, revoke it and replace it.
Create a named key:
The response includes id and api_key. Store api_key immediately; listing keys never returns it again.Use the key record’s id for rename and revoke operations, not the secret value. Revoking a key stops future requests using it.

​
Agent registration and claiming

An agent can create an account and initial key through POST /v1/accounts. The agent quickstart covers registration and how a person claims ownership. The gateway publishes auth.md and protected-resource metadata for agent discovery. Creating an agent account is separate from signing into an existing workspace.