API keys

API keys authenticate requests to Baseten. Use them to:

Deploy models, Chains, and training projects with the Truss CLI.
Call model endpoints for inference.
Use the management API.

API key types

Baseten supports three types of API keys: Personal API keys are tied to your user account. Actions performed with a personal key are attributed to you. Use personal keys for local development and testing. Personal keys are revoked when a user is deprovisioned, so don’t use them for production workloads. Team API keys are not tied to an individual user. When your organization has teams enabled, team keys can be scoped to a specific team. Team keys can have different permission levels:

Full access: Deploy models, call endpoints, and manage resources.
Inference only: Call model endpoints but cannot deploy or manage.
Metrics only: Export metrics but cannot deploy or call models.

Use team keys for CI/CD pipelines, production applications, and shared automation. Organization API keys for API key management are scoped to the organization rather than a user or team. Use them to create, list, and revoke team keys and to list or revoke personal keys. They can read team and model metadata for key scoping but cannot invoke or manage models. See API key management keys.

If your organization uses teams, Team Admins can create team API keys scoped to their team. See Teams for more information.

Environment-scoped API keys

Environment-scoped API keys are team API keys restricted to specific environments. Use them for least-privilege access when sharing keys with external partners or production integrations. You can scope a key in two ways:

By environment: The key can only call models in the selected environments (for example, production only, or production and staging).
By environment and model: The key can only call specific models within the selected environments.

To create an environment-scoped key, select Manage and call all team models or Call certain models when creating a team API key, then choose the environments from the Environment access dropdown.

API key management keys

API key management keys automate key administration without using an individual’s credentials. Provisioning tools can create team keys for new projects, rotate them on a schedule, and revoke them when access ends. API key management keys are not tied to individual users. A management key can:

List teams and models to find the IDs used to scope new keys.
Create team API keys of any permission level.
List team API keys and members’ personal API keys.
Revoke team and personal API keys.

A management key can’t invoke or manage models, create personal keys, or create other management keys. Only organization Admins can create, rename, or revoke management keys. To create one, see Create an API key.

Create an API key

Personal
Team
API key management

To create a personal API key:

Sign in to your workspace at app.baseten.co and choose API keys under Organization settings in the sidebar.
Choose Create API key.
Enter a name for the key (lowercase letters, numbers, and hyphens only).
Select Personal.
Choose Create API key.

To create an API key management key:

Sign in to your workspace at app.baseten.co and choose API keys under Organization settings in the sidebar.
Choose Create API key.
Enter a name for the key (lowercase letters, numbers, and hyphens only).
Select Organization, labeled API key management.
Choose Create API key.

To script creation, use the Management API procedure below with type WORKSPACE_MANAGE_API_KEYS. The Baseten CLI can’t create management keys.

Copy the key immediately. You won’t be able to view it again. To create a key from the Baseten CLI: Sign in with baseten auth login, then create a personal key tied to your account and permissions:

baseten org api-key create --type personal --name <label>

Save this key now. It will not be shown again.
abcd1234.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef01

Create a team key for shared automation or production use. You can limit it to specific models:

baseten org api-key create --type workspace-invoke --name <label> --model-id <model-id>

Save this key now. It will not be shown again.
abcd1234.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef01

See baseten org api-key for other key types, including workspace-manage-all and workspace-export-metrics. To create a key from the Management API: Creating a key through the API requires an existing key. Create the first key in the dashboard or CLI. To create a WORKSPACE_MANAGE_API_KEYS key, authenticate with an organization Admin’s personal key. API key type values are uppercase. Supported types: PERSONAL | WORKSPACE_MANAGE_ALL | WORKSPACE_INVOKE | WORKSPACE_EXPORT_METRICS | WORKSPACE_MANAGE_API_KEYS

curl -X POST "https://api.baseten.co/v1/api_keys" \
  -H "Authorization: Bearer $BASETEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "PERSONAL", "name": "<label>"}'

{"api_key": "abcd1234.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef01"}

See the create API key endpoint for the full request options.

Use API keys with CLIs

The first time you run truss push, Truss asks how to authenticate. Choose Paste an API key to use a key from this page. Choose Log in via browser (OAuth) to authenticate without storing a long-lived secret:

$ truss push
💻 Let's add a Baseten remote!
? How would you like to authenticate?
  Paste an API key
> Log in via browser (OAuth)

You can also sign in before pushing with truss login or its alias, truss auth login. For credential storage, OAuth, and multiple remotes, see truss auth. To configure or update an API key manually, edit ~/.trussrc:

[baseten]
remote_provider = baseten
api_key = YOUR_API_KEY

The Baseten CLI reads BASETEN_API_KEY from the environment or uses a profile stored by baseten auth login.

Use API keys with endpoints

Set your key as an environment variable, or store it in your secret manager:

export BASETEN_API_KEY="paste-your-api-key-here"

setx BASETEN_API_KEY "paste-your-api-key-here"

Pass your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer $BASETEN_API_KEY

Bearer works with OpenAI-style clients and AI gateways such as LiteLLM and OpenRouter without extra configuration. Baseten also accepts the legacy Api-Key scheme on every endpoint, so existing scripts using Authorization: Api-Key <key> continue to work:

Authorization: Api-Key $BASETEN_API_KEY

For runnable examples, see Call your model.

Frontier Gateway federated API keys are the exception: they only accept the Api-Key scheme. Workspace API keys used to manage gateway groups still accept either scheme.

Manage API keys

The API keys page shows each visible key’s creation date and last-used timestamp. Use these timestamps to identify unused keys.

View and revoke keys as an organization Admin

Organization Admins see every key in the workspace: all team API keys plus every member’s personal API keys. The Owner / Team column shows who each key belongs to: the owning member for personal keys, or the team for team keys. Use the Member, Team, and Type filters to narrow the list. Organization Admins can revoke any key in the workspace, including other members’ personal keys. Admins can’t rename other members’ personal keys. To see who created a team API key, check the audit log. All other roles see their own personal keys and any team keys they created. Team Admins also see every key scoped to their teams. The list API keys endpoint follows the same visibility rules. Each personal key includes an owner object with the member’s user_id, email, and name. API key management keys can list and revoke team and personal keys across the organization, making them suitable for automated key rotation and cleanup.

Rename, rotate, or revoke keys

API keys don’t automatically expire. To maintain security, rotate keys periodically and revoke any that are no longer in use. To rename a key, select the pencil icon next to the key name. To rotate a key, create a new key, update your applications to use it, then revoke the old key. To revoke a key, select the trash icon next to the key. Revoked keys cannot be restored. You can also revoke a key programmatically, by its visible prefix: baseten org api-key delete --prefix <prefix> from the CLI, or the delete API key endpoint.

Security recommendations

Store API keys in environment variables or secret managers, not in code.
Never commit API keys to version control.
Use environment-scoped keys to limit access to specific environments and models.
Use team keys with minimal permissions for production applications.
Rotate keys periodically and revoke unused keys.
Monitor key creation, deletion, and use through the audit log.

Get started

Model APIs

Inference

Training

Development

Deployment

Engines

Model Labs

Organization

Hosting options

Observability

Troubleshooting

API key types

Environment-scoped API keys

API key management keys

Create an API key

Use API keys with CLIs

Use API keys with endpoints

Manage API keys

View and revoke keys as an organization Admin

Rename, rotate, or revoke keys

Security recommendations

​API key types

​Environment-scoped API keys

​API key management keys

​Create an API key

​Use API keys with CLIs

​Use API keys with endpoints

​Manage API keys

​View and revoke keys as an organization Admin

​Rename, rotate, or revoke keys

​Security recommendations

API key types

Environment-scoped API keys

API key management keys

Create an API key

Use API keys with CLIs

Use API keys with endpoints

Manage API keys

View and revoke keys as an organization Admin

Rename, rotate, or revoke keys

Security recommendations