API keys

API keys authenticate deployment, inference, and Management API requests. Choose a key type and access scope for your workload.

Choose a key type

Personal API keys are tied to your user account. Actions performed with a personal key are attributed to you. Use personal keys for local development and testing. Personal keys are revoked when a user is deprovisioned, so don’t use them for production workloads. For local development with the Baseten CLI, you don’t need a personal key: baseten auth login --web signs you in through your browser, so there’s no key to store or rotate. Team API keys are not tied to an individual user. When your organization has teams enabled, team keys can be scoped to a specific team. Team keys can have different permission levels:

Full access: Deploy models, call endpoints, and manage resources.
Inference only: Call model endpoints but cannot deploy or manage.
Metrics only: Export metrics but cannot deploy or call models.

Use team keys for CI/CD pipelines, production applications, and shared automation. For CI that starts Loops runs or Training Jobs and deploys checkpoints, choose Manage and call all team models in the team that owns the training resources. Call certain models grants inference access; it doesn’t authorize starting training or deploying checkpoints. Ask a Team Admin to create the key if you can’t select the team. API key management keys are scoped to your organization. Use them to automate team key creation and to list or revoke team and personal keys. For more information, see API key management keys.

If your organization uses teams, Team Admins can create team API keys scoped to their team. For more information, see Teams.

Environment-scoped API keys

Environment-scoped API keys are team API keys restricted to specific environments. Use them for least-privilege access when sharing keys with external partners or production integrations. You can scope a key in two ways:

By environment: The key can only call models in the selected environments (for example, production only, or production and staging).
By environment and model: The key can only call specific models within the selected environments.

To create an environment-scoped key, select Manage and call all team models or Call certain models when creating a team API key, then choose the environments from the Restricted environment access dropdown.

API key management keys

Use an API key management key to provision and rotate team keys without an individual’s credentials. A management key can:

List teams and models to find the IDs used to scope new keys.
Create team API keys of any permission level.
List team API keys and members’ personal API keys.
Revoke team and personal API keys.

A management key can’t invoke or manage models, create personal keys, or create other management keys. Only organization Admins can create, rename, or revoke management keys. For more information, see Create an API key.

Key expiration

Set an expiration when you create a key. You can’t change it afterward; rotate the key to replace it with one that has a different expiration. An expired key stops authenticating requests.

Key type	Expiration for new keys
Personal	Required, within 90 days or your organization’s limit, whichever is shorter.
Team	Optional unless your organization sets a limit.
API key management	Optional unless your organization sets a limit.

The dashboard offers 7 days, 30 days, and 90 days, subject to your organization’s limits. Team and API key management keys also offer Never when no limit applies. The Baseten CLI and Management API accept a future timestamp within the applicable limit. Organization Admins can set expiration limits for new keys; changing a limit doesn’t change existing keys. Keys created before expiration was introduced have no expiration. Expired keys stay on the API keys page, marked Expired in the Expires column, so you can recreate them. Revoked keys can’t be recreated. Baseten emails the key’s creator a reminder a week before expiration and again the day before. Each reminder includes the key’s last-used timestamp. Team Admins also receive reminders for team keys; Organization Admins receive them for API key management keys.

Automatic revocation of unused personal keys

Baseten automatically revokes personal API keys that haven’t authenticated a request in 30 days, including personal keys with no expiration. Team and API key management keys aren’t revoked for inactivity. Their configured expiration still applies. Check personal keys’ last-used timestamps on the API keys page to find keys approaching revocation. Use a team key for workloads that run less often than every 30 days. Revocation is permanent; create a replacement and update the affected clients to restore access.

Create an API key

Choose the key type and access your workload needs. Use a personal key for local development, a team key for production, or an API key management key for key administration.

UI
Baseten CLI
Management API

To create an API key:

Open the API keys page

Name the key

Choose Create API key. For Name, enter a name using lowercase letters, numbers, and hyphens, such as production-inference.

Set access and expiration

Select the key type for your workload:

Personal

Select Personal.
For Expiration, choose an available duration within your organization’s limit, up to 90 days.

The key inherits your account’s permissions.

Team

Select Team.
For Expiration, choose an available duration, or Never if your organization allows keys without an expiration.
Choose Next.
Under Team scope, select the team that owns the resources.
Under Permissions, select the access the key needs:
- Manage and call all team models: Deploy, call, and manage team resources.
- Call certain models: Call the selected models. Select All models only when the key needs access to every model in the team, including models added later.
- Export model metrics: Export metrics without deployment or inference access.
- Call Model APIs: Call Model APIs.
For Manage and call all team models or Call certain models, use Restricted environment access if the key should only access specific environments.

API key management

Only Organization Admins can create these keys.

Select API key management.
For Expiration, choose an available duration, or Never if your organization allows it.

Create and save the key

Choose Create API key and copy the key immediately. Store it in your secret manager or environment variables; you can’t view it again.

Check the key's access

Confirm that the new key’s Owner and Expires values match your selections. For a team key, open its details and check the permissions, allowed models, and environment restrictions.

To create an API key:Install the Baseten CLI before you begin.

Sign in with the following command:
baseten auth login
Replace <expires-at> with a future ISO 8601 timestamp within the expiration limit, such as 2027-01-15T00:00:00Z. Include Z for UTC or an explicit offset; values without a time zone use your local time zone. Run the command for the key type you need:
Personal key
Create a personal key for local development:
Command
baseten org api-key create \ --type personal \ --name local-development \ --expires-at "<expires-at>"
Output (key redacted)
Save this key now. It will not be shown again. <new-api-key>
Team inference key
Replace <team> with the team’s name or ID and <model-id> with a model the key can call. Repeat --model-id for each allowed model; omitting model IDs grants access to all team models:
Command
baseten org api-key create \ --type workspace-invoke \ --name production-inference \ --team "<team>" \ --model-id "<model-id>" \ --expires-at "<expires-at>"
Output (key redacted)
Save this key now. It will not be shown again. <new-api-key>
API key management key
Create a management key as an Organization Admin:
Command
baseten org api-key create \ --type workspace-manage-api-keys \ --name api-key-admin \ --expires-at "<expires-at>"
Output (key redacted)
Save this key now. It will not be shown again. <new-api-key>
Copy the new key immediately. Personal keys require an expiration. For team and API key management keys, omit --expires-at only when your organization allows keys without an expiration.
Check the saved key’s metadata with the following command:
Command
baseten org api-key list
Example output
NAME KEY TYPE TEAM EXPIRES production-inference b10_abcd1234**** workspace-invoke production 2027-01-15T00:00:00Z
Find the new key by name and check its type, team, and expiration. The expiration is shown in UTC, or as never when the key has no scheduled expiration. Personal keys can still be revoked for inactivity. For a model-restricted key, check the complete model list in the dashboard or REST listing; the CLI table doesn’t show it.

For more information, see baseten org api-key for full-access and metrics-only keys. Use the dashboard for environment restrictions or keys that only call Model APIs.

To create an API key:Keep the credential used for key administration separate from the new key.

Choose the key type and run its creation request:
string
A future ISO 8601 timestamp, such as 2027-01-15T00:00:00Z, within your organization’s limit. Personal keys must expire within 90 days. Baseten reads timestamps without a time zone as UTC. For team and management keys, omit this field only when your organization allows keys without an expiration.
Personal key
Set BASETEN_API_KEY to your own personal key. Replace <expires-at> with the expiration and run the following request:
Request
curl -X POST "https://api.baseten.co/v1/api_keys" \ -H "Authorization: Bearer $BASETEN_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "type": "PERSONAL", "name": "local-development", "expires_at": "<expires-at>" }'
Response
{"api_key": "<new-api-key>"}
Team inference key
Set BASETEN_API_KEY to an API key management key or a personal key authorized to create keys for the team. Replace <team-id> with the owning team’s ID from List all teams, <model-id> with an allowed model, and <expires-at> with the expiration. Run the following request:
Request
curl -X POST "https://api.baseten.co/v1/teams/<team-id>/api_keys" \ -H "Authorization: Bearer $BASETEN_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "type": "WORKSPACE_INVOKE", "name": "production-inference", "model_ids": ["<model-id>"], "expires_at": "<expires-at>" }'
Response
{"api_key": "<new-api-key>"}
Include every allowed model in model_ids. Omitting it, setting it to null, or passing an empty list grants access to all team models. WORKSPACE_EXPORT_METRICS supports the same model list; WORKSPACE_MANAGE_ALL grants full team access and doesn’t take a model list.
API key management key
Set BASETEN_API_KEY to an Organization Admin’s personal key. Replace <expires-at> with the expiration and run the following request:
Request
curl -X POST "https://api.baseten.co/v1/api_keys" \ -H "Authorization: Bearer $BASETEN_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "type": "WORKSPACE_MANAGE_API_KEYS", "name": "api-key-admin", "expires_at": "<expires-at>" }'
Response
{"api_key": "<new-api-key>"}
Copy the returned api_key immediately; you can’t retrieve it again. Check the saved settings with List API keys:
curl "https://api.baseten.co/v1/api_keys" \ -H "Authorization: Bearer $BASETEN_API_KEY"
Find the new entry in keys and check its type, team_name, model_ids, and expires_at against the values you selected. The listing returns metadata, not the secret.

For more information, see Create an API key and Create a team API key. Use the dashboard to configure environment restrictions or keys that only call Model APIs.

Use API keys with CLIs

The Baseten CLI reads an API key from the BASETEN_API_KEY environment variable. To sign in through your browser or save an API key in a profile, run the following command:

Command

baseten auth login

Sign-in prompt

? How would you like to authenticate?
> Login with Baseten credentials (browser)
  Paste an API key

For more information about non-interactive sign-in and credential profiles, see baseten auth login. For the Truss CLI, the first truss push asks how to authenticate, with the same choice of pasting an API key or logging in via browser (OAuth). You can also sign in before pushing with truss login or its alias, truss auth login. For more information about credential storage, OAuth, and multiple remotes, see truss auth. To configure or update an API key manually, edit ~/.trussrc:

[baseten]
remote_provider = baseten
api_key = YOUR_API_KEY

Use API keys with endpoints

Set your key as an environment variable, or store it in your secret manager:

export BASETEN_API_KEY="YOUR_API_KEY"

$env:BASETEN_API_KEY = "YOUR_API_KEY"

Pass your API key in the Authorization header using the Bearer scheme:

Authorization: Bearer $BASETEN_API_KEY

Bearer works with OpenAI-style clients and AI gateways such as LiteLLM and OpenRouter without extra configuration. Baseten also accepts the legacy Api-Key scheme on every endpoint, so existing scripts using Authorization: Api-Key <key> continue to work:

Authorization: Api-Key $BASETEN_API_KEY

For more information, see Call your model.

Frontier Gateway federated API keys are the exception: they only accept the Api-Key scheme. Workspace API keys used to manage gateway groups still accept either scheme.

Rotate a key

Create a replacement with the original key’s type, team, model access, and environment restrictions. Update and test the workload with the replacement before revoking the original. To change the expiration of an existing key, set the new expiration on its replacement. To recreate a key in the dashboard, you must own the personal key, be a Team or Organization Admin for a team key, or be an Organization Admin for a management key. Seeing a key in the list doesn’t grant permission to recreate it.

Create a replacement

Use dashboard recreation for environment-restricted keys and keys that only call Model APIs. It copies the original key’s current permissions. For CLI and REST creation, preserve the type, team, and complete model list from your provisioning configuration.

UI
Baseten CLI
Management API

To recreate the key with its existing access:

On the API keys page, choose API key actions next to the original key, then Recreate API key.
For Name, enter a new name, such as production-inference-replacement.
For Expiration, choose how long the replacement should last.
Choose Create API key and copy the new key immediately.

The replacement appears as a separate key with its own expiration. The original key remains unchanged. You can recreate an expired key, but not a revoked one.

To replace a model-restricted team inference key:Use this path for a key without environment restrictions. Replace <team> with the original team, <model-id> with an allowed model, and <expires-at> with the replacement’s expiration within the applicable limit. Repeat --model-id for every model the original could call. Run the following command:

Command

baseten org api-key create \
  --type workspace-invoke \
  --name production-inference-replacement \
  --team "<team>" \
  --model-id "<model-id>" \
  --expires-at "<expires-at>"

Output (key redacted)

Save this key now. It will not be shown again.
<replacement-api-key>

Copy the new key immediately. Omit --expires-at only when your organization allows keys without an expiration. For other key types, use the corresponding creation procedure with the original type and access.

To replace a model-restricted team inference key:Set BASETEN_API_KEY to an administrative credential that can create team keys. Replace <team-id> with the original team, <model-id> with an allowed model, and <expires-at> with the permitted expiration. Include the original key’s complete model list:

Request

curl -X POST "https://api.baseten.co/v1/teams/<team-id>/api_keys" \
  -H "Authorization: Bearer $BASETEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "WORKSPACE_INVOKE",
    "name": "production-inference-replacement",
    "model_ids": ["<model-id>"],
    "expires_at": "<expires-at>"
  }'

Response

{"api_key": "<replacement-api-key>"}

Copy the new key immediately. For other key types, use the matching creation procedure with the original type and access. API key management keys can’t create replacement personal or management keys.

Check the replacement's access

Check the replacement’s type, team, and expiration on the API keys page, with baseten org api-key list, or with List API keys. Confirm that it has a different prefix from the original.Check the complete model list in the dashboard or REST listing. Check environment restrictions and Model APIs access in the dashboard; neither listing includes these settings.

Update and test the workload

Update the application’s secret or environment variable to use the replacement. Restart or redeploy the application if it loads credentials only at startup.Run an operation the workload normally performs with the replacement key, such as an inference request or a metrics export. Confirm that it returns the expected result without authentication or permission errors before revoking the original.

Revoke the original

Revoke the original key by its original prefix. Keep the replacement active and confirm that the workload continues to succeed afterward.

Revoke a key

Revocation is permanent, and requests using the key stop authenticating. If a workload still needs the access, rotate its key first. If a key is exposed, revoke it immediately.

UI
Baseten CLI
Management API

To revoke an API key:

On the API keys page, choose API key actions next to the key, then Revoke API key.
Choose Delete key to confirm.

The key no longer appears in the active key list.

To revoke an API key:

List keys and identify the original key by its name and prefix:
baseten org api-key list
Replace <key-prefix> with the original key’s prefix, including b10_ when present. Run the following command:
Command
baseten org api-key delete --prefix "<key-prefix>"
Deletion output
Deleted API key <key-prefix>
List keys again and confirm that the revoked prefix no longer appears:
baseten org api-key list

To revoke an API key:Set BASETEN_API_KEY to a different credential authorized to revoke the target key, so you can check the result afterward. To revoke a management key, use an Organization Admin’s personal key.

Replace <key-prefix> with the original key’s prefix from List API keys, including b10_ when present. Run the following request:

Request

curl -X DELETE "https://api.baseten.co/v1/api_keys/<key-prefix>" \
  -H "Authorization: Bearer $BASETEN_API_KEY"

Response

{"prefix": "<key-prefix>"}

List keys again and confirm that the revoked prefix no longer appears:

curl "https://api.baseten.co/v1/api_keys" \
  -H "Authorization: Bearer $BASETEN_API_KEY"

Rename a key

Rename keys in the dashboard:

On the API keys page, choose the key to open its details.
Choose Edit name, enter a new name, and save it.

The list shows the updated name. The key’s value and permissions stay the same. The CLI and Management API don’t rename keys.

Administer API keys

The API keys page shows each visible key’s creation date, expiration, and last-used timestamp. Use expiration dates to plan rotation and personal keys’ last-used timestamps to find keys approaching automatic revocation.

View and revoke keys as an organization Admin

Organization Admins see every key in the workspace: all team API keys plus every member’s personal API keys. The Owner column shows who each key belongs to: the owning member for personal keys, or the team for team keys. Use the Member, Team, and Type filters to narrow the list. Organization Admins can revoke any key in the workspace, including other members’ personal keys. Admins can’t rename other members’ personal keys. To see who created a team API key, check the audit log. All other roles see their own personal keys and any team keys they created. Team Admins also see every key scoped to their teams. The list API keys endpoint follows the same visibility rules. Each personal key includes an owner object with the member’s user_id, email, and name. API key management keys can list and revoke team and personal keys across the organization, making them suitable for automated key rotation and cleanup.

Set expiration limits

As an Organization Admin, set separate expiration limits for personal keys and for team and API key management keys in the dashboard. Changes apply only to new keys; the CLI and Management API don’t expose these settings.

On the API keys page, under Expiration configuration, choose Set expiration limits.
For Personal key expiration, select 7, 30, or 90 days. Default (90 days) keeps the 90-day maximum.
For Team & Organization key expiration, select 7, 30, or 90 days, 1 year, or No limit. This limit applies to team and API key management keys.
Choose Save.

The summary under Expiration configuration shows the saved limits. When you create a key, the Expiration menu offers only values within them, and Never is unavailable when a limit applies to team and API key management keys. The audit log records each change.

Control who can create API keys

As an Organization Admin, you can stop new personal API keys, new team and API key management keys, or both. Existing keys keep working. Get the current organization to read the settings, or update the current organization to change them. Omitted fields keep their current values.

boolean

Whether members can create new personal API keys. Set it to true to allow new keys again. null isn’t accepted.

boolean

Whether Team Admins can create team keys and Organization Admins can create API key management keys. Set it to true to allow new keys again. null isn’t accepted. Despite its name, this field doesn’t control service accounts.

Set BASETEN_API_KEY to a Baseten API key with Organization Admin permissions. To stop new personal API keys: Run the following command:

curl --request PATCH \
  --url "https://api.baseten.co/v1/organizations/me" \
  --header "Authorization: Bearer $BASETEN_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"allow_personal_api_keys": false}'

The response returns the updated organization. Check that allow_personal_api_keys is false. To stop new team and API key management keys: Run the following command:

curl --request PATCH \
  --url "https://api.baseten.co/v1/organizations/me" \
  --header "Authorization: Bearer $BASETEN_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"allow_service_account_api_keys": false}'

The response returns the updated organization. Check that allow_service_account_api_keys is false.

API key format

Baseten API keys use the stable b10_ prefix so secret-scanning tools can identify exposed credentials. Configure your scanner to match the complete key format:

b10_[A-Za-z0-9]{8}\.[A-Za-z0-9]{32}

Keys created before 15:30 UTC on November 9, 2026, don’t contain the b10_ prefix, so this regular expression detects only keys created on or after that time.

If a key is exposed, revoke it immediately and create a replacement.

Security recommendations

For local development with the Baseten CLI, sign in with baseten auth login --web instead of storing a personal key.
Store API keys in environment variables or secret managers, not in code.
Never commit API keys to version control.
Use environment-scoped keys to limit access to specific environments and models.
Use team keys with minimal permissions for production applications.
Set the shortest expiration that fits the workload. Rotate keys before they expire.
Monitor key creation, deletion, and use through the audit log.

Get started

Model APIs

Inference

Training

Baseten Grid

Frontier Gateway

Sandboxes

Development

Deployment

Engines

Model Labs

Organization

Hosting options

Observability

Troubleshooting

Choose a key type

Environment-scoped API keys

API key management keys

Key expiration

Automatic revocation of unused personal keys

Create an API key

Use API keys with CLIs

Use API keys with endpoints

Rotate a key

Revoke a key

Rename a key

Administer API keys

View and revoke keys as an organization Admin

Set expiration limits

Control who can create API keys

API key format

Security recommendations