Manage Gateway API keys
Create, restrict, inspect, and revoke the credentials used for model requests.
Gateway API keys authenticate model requests to https://edgee.io. Manage them in API Keys. For a first request, follow Create an API key.
Choose the right credential
| Credential | Used for | Managed in |
|---|---|---|
| Gateway API key | Model requests through Edgee | API Keys or a member's agent settings |
| Provider key | Your account at Anthropic, OpenAI, or another provider | BYOK |
| Personal API token | Organization management through the Console API | Account settings → Personal API Tokens |
The CLI can provision coding-agent credentials during sign-in and launch. Do not replace them with a personal Console API token.
Personal or service
Ordinary Gateway keys can be Personal or Service. Organization admins can select Service when creating a key for a backend, CI job, or other workload. Service keys belong to the organization, require no member seat, and remain valid when their creator leaves. Only organization admins can view or manage them. Created by is audit information, not the identity charged for requests.
Service usage appears in organization and API-key totals, not member or squad totals. Organization controls and key limits still apply. Inherited per-member routing budgets and model-limit rules don't, since there is no member to count against; cap a service key with a shared policy or a key limit. Ownership cannot be changed after creation. Service keys default to a 90-day expiry.
Find and manage keys
Use the navigation below the page header to choose All keys, Service, Personal, Coding agents, or Integrations. Search and Filters sit beside Create API key in the page header. Filter by status (active, disabled, expired, or expiring within seven days), or search by name, agent, email, or key ID. Clear all filters resets search and status, keeping the category.
Open a key's actions menu and choose Settings to edit it. Click its spending limit for quick budget changes. The menu also includes Show dashboard for this key, logs, enable/disable, rotation, and deletion. Lifetime usage is all-time spend, not consumption within the limit's current period.
Choose Coding agent in Create API key, or use Create coding agent key under Coding agents, to enroll an available assistant for your account with setup instructions. Existing seat rules and inherited organization/squad restrictions apply.
Create and verify
- Open API Keys, create a key, and use a name identifying its application or environment.
- Configure the available model restrictions, spending limit, and expiry to match that use.
- Copy the key into the application's secret storage.
- Send the test request.
- Find the request in Logs, filtered to that key.
Restrict a key
A model allowlist limits the key to those models, within the organization's model access rules. It cannot re-enable a route disabled by the organization.
Set a usage limit with a period. Compression, routing, and BYOK settings can be inherited or enforced at a higher scope; see Gateway settings.
Enable Debug only for an investigation. It captures request/response content for future requests; see Debug logs.
Rotate or revoke
Create a replacement key, update the application secret, and verify a successful request with the new key before deleting the old one. Deleting a key can stop clients still using it. For a departed member, also review organization membership and any independently shared credentials.
For a service key, Rotate key replaces its secret while keeping its ID, settings, and usage history. Rotation renews expiry for 90 days and shows the replacement secret once. There is no grace period for the old credential: coordinate the application secret update before rotating. Service keys are not service accounts with multiple simultaneously valid credentials.
Do not put keys in source code, screenshots, or browser-side application code. For scripted creation, update, reveal, and deletion, use Manage Gateway API keys through the Console API.