Security
Best practices for API keys
Securely access your Baseten models
API keys enable secure access to Baseten models for:
- Model deployment via Truss CLI
- Inference API calls (
truss predict
,/wake
requests) - Model management via the management API
- Metrics export via the
/metrics
endpoint
You can create and revoke API keys from your Baseten account.
API key scope: Personal vs Workspace
There are two types of API keys on Baseten:
Personal API Keys:
- Tied to a user account.
- Inherit full workspace permissions.
- Actions are linked to the specific user.
Workspace API Keys:
- Shared across a workspace.
- Can have full access or be restricted to specific models.
Use personal keys for testing and workspace keys for automation and production.
Using API keys with Truss
Add your API key to ~/.trussrc
for authentication:
~/.trussrc
If rotating keys, update the file with the new key.
Using API keys with endpoints
Include the API key in request headers:
Or in Python:
Tips for managing API keys
Best practices for API key use apply to your Baseten API keys:
- Always store API keys securely.
- Never commit API keys to your codebase.
- Never share or leak API keys in notebooks or screenshots.
The API key list on your Baseten account shows when each key was first created and last used. Rotate API keys regularly and remove any unused API keys to reduce the risk of accidental leaks.