Skip to main content

Virtual API keys

A virtual API key authenticates scripts, continuous integration jobs, and other clients that cannot complete an interactive sign-in. Each key is bound to its owner's directory identity, so requests retain the owner's access, budget, and audit attribution.

Where to find them​

Users manage their keys under API keys in Your workspace. Administrators can list and disable other users' keys through the API.

Prerequisites​

Configure the platform identity provider before enabling virtual keys. The AI Gateway validates this dependency at startup.

Enabling virtual keys also deploys the AI Gateway management API used by the console.

Issue a key​

  1. Open API keys in the console.
  2. Use Create key and give it a name that says where it will be used.
  3. Copy the value immediately. It is shown once and cannot be retrieved afterwards; only its prefix is stored for identification.

Users follow the instructions in the console to configure their client. See Roll out gateway clients.

Revoke a key​

Use Revoke to invalidate a compromised key immediately. Use Disable for a reversible suspension.

Rotate a key​

The API can rotate a key while preserving its name and history.

The previous value remains valid for 24 hours after rotation. Revoke a compromised key because rotation retains this grace period.

Key creation, rotation, revocation, and enable or disable changes are all recorded in the audit trail, along with the identity that made the change. See Forward audit logs.

Storage​

The directory stores a hash of each key and returns plaintext only when creating or rotating it. The gateway validates the hash and resolves the owner on each request.

Next steps​