API keys
An API key authenticates requests to the public API as your organization: everything a key serves, banks, or teaches belongs to the organization that minted it. A key carries exactly the permissions you grant it at creation — nothing is inherited from roles, and no permission implies another.
§1Creating a key
Open the console → API keys (requires the keys:write role permission — owners and admins have it). Name the key after its consumer, pick its permissions, and create it.
The secret — a token starting with sk_ — is shown once, in the creation response. Copy it then: no later view can recover it, and the list shows only an obfuscated form. A lost secret means revoking the key and minting a new one.
§2Authenticating requests
Send the key as a bearer token on every request. The OpenAI SDKs do this with their apiKey option. The Anthropic SDKs send it as an x-api-key header, which is accepted the same way.
§3Permissions
Permissions name capabilities, not endpoints. The two levels are deliberately unordered: neither implies the other, and a key holds any subset.
| Permission | Grants |
|---|---|
models:infer | Run inference — completions and verdicts from any model on the eval API. |
models:train | Teach models: requests that carry expected (see fine-tuning). Teaching changes what your organization's models know, so a key without this permission cannot affect them — safe to embed where you only need answers. |
expected needs models:train, any other eval body needs models:infer, and the models list accepts either.§4Revocation
Revoking a key expires it: requests using it start failing with 401 within about a minute — verification results are cached briefly, so revocation is fast but not instant. The key stays in the list, marked revoked, as an auditable record. Rotation is the same move: mint the replacement first, move the consumer over, then revoke the old key.
§5Errors
401 | No credential on the request, or the key is invalid or revoked. |
403 | The key is valid but lacks the permission the request needs. |
503 | Key verification is temporarily unavailable. Retry with your own backoff — the request never fails open. |
The full status taxonomy, including the eval-specific codes, is in the reference.