> ## Documentation Index > Fetch the complete documentation index at: https://dev-docs.altrum.ai/llms.txt > Use this file to discover all available pages before exploring further. # Virtual keys > Create the keys your applications and people use to send requests through the AI Gateway, and attach them to AI systems. This is in development. Details may change before it is available. A virtual key is what an application or a person sends to the AI Gateway. It says who is calling, which rules apply, and which provider credentials may be used. It is not a provider credential, so a leaked key can be revoked in Altrum without touching your provider accounts. ## Three kinds of key | Kind | Belongs to | Use it for | Created by | | - | - | - | - | | Organization key | Your organization | Traffic you have not tied to an AI system yet | Owners and admins | | AI system key | One AI system | An application that is a registered AI system | Owners and admins | | Personal key | One person | Your own coding agent or experiments | Any member, when an admin allows it | Each key follows the rules of what it belongs to: the guardrails, budget, rate limit, model access and cache of the AI system, or of the organization for organization and personal keys. A key whose owner has no live guardrails shows **Unguarded**: nothing checks its requests until guardrails are applied. A key can also have its own budget, rate limit, providers and models. An expiry date is optional. A key with no providers chosen can use every provider your organization has stored a credential for. ## Create a key Open **AI Gateway**, then **Virtual keys**, and choose **Create key**. Name it, and optionally describe it, set when it **Expires** (never, in 30 or 90 days, or on a date), choose its **Providers and models**, its **Limits** and the **MCP tools** it may use. To make it an AI system's key from the start, choose the **AI system**. Copy the key when it is shown: it is shown once and cannot be shown again. The list shows only its last four characters. ## Send it Clients send the key the way their SDK sends an API key: in `Authorization: Bearer`, `x-api-key` or `x-goog-api-key`. You do not need to change your code beyond the base URL and the key. See [SDKs](/ai-gateway/sdks). ## Attach an organization key to an AI system When you register the AI system an organization key's traffic belongs to, attach the key to it. From the next request, the AI system's guardrails, budget, rate limit and cache apply. Earlier requests in the log keep their organization attribution. A key can be attached once. It cannot be moved to another AI system or detached, and a personal key cannot be attached. ## Personal keys An admin allows personal keys under **AI Gateway**, **Settings**, **Access** and sets the defaults every personal key starts with: a budget, a request limit and the models it may use. The defaults are copied when a member makes a key, so changing them later does not change keys that exist. Admins can tighten any personal key. A personal key is still held to the organization's own budget and limits. A personal key is also how Altrum knows who you are when an MCP tool needs your own account. See [MCP tools](/ai-gateway/mcp). When a member is removed from the organization, or their account is disabled, their personal keys stop working. Enabling the account again does not bring them back: the member makes new ones. ## Rotate and revoke Each key's menu has **Edit**, **Rotate**, **Switch off** (or **Switch on**), **Revoke** and, for an organization key, **Attach to an AI system**. **Rotate** issues a new value for the same key, keeping its settings and history, and shows it once. The old value stops working at once. **Switch off** refuses the key's requests until it is switched on again. **Revoke** stops a key for good. A member can rotate and revoke their own personal keys under **AI Gateway**, **My keys**; owners and admins can do the same for any key. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.