This is in development. Details may change before it is available.
Three kinds of key
Each key follows the rules of what it belongs to: the guardrails, budget, rate limit, model access and cache of the AI system, or of the organization for organization and personal keys. A key can also have its own budget, rate limit, providers and models. An expiry date is optional. A key with no providers chosen can use every provider your organization has stored a credential for.
Create a key
Open AI Gateway, then Virtual keys, and choose Create key. Name it, and optionally describe it, set when it Expires (never, in 30 or 90 days, or on a date), choose its Providers and models, its Limits and the MCP tools it may use. To make it an AI system’s key from the start, choose the AI system. Copy the key when it is shown: it is shown once and cannot be shown again. The list shows only its last four characters.
Send it
Clients send the key the way their SDK sends an API key: in Authorization: Bearer, x-api-key or x-goog-api-key. You do not need to change your code beyond the base URL and the key. See SDKs.
Attach an organization key to an AI system
When you register the AI system an organization key’s traffic belongs to, attach the key to it. From the next request, the AI system’s guardrails, budget, rate limit and cache apply. Earlier requests in the log keep their organization attribution. A key can be attached once. It cannot be moved to another AI system or detached, and a personal key cannot be attached.
Personal keys
An admin allows personal keys under AI Gateway, Settings, Access and sets the defaults every personal key starts with: a budget, a request limit and the models it may use. The defaults are copied when a member makes a key, so changing them later does not change keys that exist. Admins can tighten any personal key. A personal key is still held to the organization’s own budget and limits. A personal key is also how Altrum knows who you are when an MCP tool needs your own account. See MCP tools.
When a member is removed from the organization, or their account is disabled, their personal keys stop working. Enabling the account again does not bring them back: the member makes new ones.
Rotate and revoke
Each key’s menu has Edit, Rotate, Switch off (or Switch on), Revoke and, for an organization key, Attach to an AI system. Rotate issues a new value for the same key, keeping its settings and history, and shows it once. The old value stops working at once. Switch off refuses the key’s requests until it is switched on again. Revoke stops a key for good. A member can rotate and revoke their own personal keys under AI Gateway, My keys; owners and admins can do the same for any key.
