> ## Documentation Index
> Fetch the complete documentation index at: https://docs.baseten.co/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Authenticate requests to Baseten for deployment, inference, and management.

API keys authenticate your requests to Baseten. You need an API key to:

* Deploy models, Chains, and training projects with the Truss CLI.
* Call model endpoints for inference.
* Use the management API.

## API key types

Baseten supports three types of API keys:

**Personal API keys** are tied to your user account. Actions performed with a personal key are attributed to you. Use personal keys for local development and testing. Personal keys are revoked when a user is [deprovisioned](/organization/sso-and-scim#deprovisioning), so don't use them for production workloads.

**Team API keys** are not tied to an individual user. When your organization has [teams](/organization/teams) enabled, team keys can be scoped to a specific team. Team keys can have different permission levels:

* **Full access**: Deploy models, call endpoints, and manage resources.
* **Inference only**: Call model endpoints but cannot deploy or manage.
* **Metrics only**: Export metrics but cannot deploy or call models.

Use team keys for CI/CD pipelines, production applications, and shared automation.

**Organization API keys for API key management** are scoped to your organization rather than a user or team. They create, list, and revoke team keys, as well as list and revoke personal keys. They can read team and model metadata for key scoping, but can't invoke or manage models. Use them to automate key administration. See [API key management keys](#api-key-management-keys).

<Note>
  If your organization uses [teams](/organization/teams), Team Admins can create team API keys scoped to their team. See [Teams](/organization/teams) for more information.
</Note>

### Environment-scoped API keys

Environment-scoped API keys are team API keys restricted to specific [environments](/deployment/environments). Use them for least-privilege access when sharing keys with external partners or production integrations.

You can scope a key in two ways:

* **By environment**: The key can only call models in the selected environments (for example, `production` only, or `production` and `staging`).
* **By environment and model**: The key can only call specific models within the selected environments.

To create an environment-scoped key, select **Manage and call all team models** or **Call certain models** when [creating a team API key](#create-an-api-key), then choose the environments from the **Environment access** dropdown.

### API key management keys

API key management keys let your provisioning tooling manage keys the way [SCIM](/organization/sso-and-scim) manages users: create team keys for new projects, rotate them on a schedule, and revoke them when access ends, all without a human in the dashboard. API key management keys are not tied to individual users.

A management key can:

* List [teams](/reference/management-api/teams/lists-all-teams) and [models](/reference/management-api/models/gets-all-models) to find the IDs used to scope new keys.
* Create team API keys of any permission level.
* List team API keys and members' personal API keys.
* Revoke team and personal API keys.

A management key can't invoke or manage models, create personal keys, or create other management keys.

Only organization Admins can create, rename, or revoke management keys.

To create one, see [Create an API key](#create-an-api-key).

## Create an API key

<Tabs>
  <Tab title="Personal">
    **To create a personal API key**:

    1. Sign in to your workspace at [app.baseten.co](https://app.baseten.co) and choose [**API keys**](https://app.baseten.co/settings/api_keys) under **Organization settings** in the sidebar.
    2. Choose **Create API key**.
    3. Enter a name for the key (lowercase letters, numbers, and hyphens only).
    4. Select **Personal**.
    5. Choose **Create API key**.
  </Tab>

  <Tab title="Team">
    **To create a team API key**:

    1. Sign in to your workspace at [app.baseten.co](https://app.baseten.co) and choose [**API keys**](https://app.baseten.co/settings/api_keys) under **Organization settings** in the sidebar.
    2. Choose **Create API key**.
    3. Enter a name for the key (lowercase letters, numbers, and hyphens only).
    4. Select **Team** and choose **Next**.
    5. If your organization has multiple teams, select the team.
    6. Select the permission level:
       * **Manage and call all team models**: Full access to deploy, call, and manage.
       * **Call certain models**: Inference-only access to selected models. Choose **All models** so the key can call every model in the team, including models you add later.
       * **Export model metrics**: Metrics-only access.
       * **Call Model APIs**: Access to call Model APIs.
    7. For **Manage and call all team models** or **Call certain models**, optionally use the **Restricted environment access** dropdown to restrict the key to specific environments.
    8. Choose **Create API key**.
  </Tab>

  <Tab title="API key management">
    **To create an API key management key**:

    1. Sign in to your workspace at [app.baseten.co](https://app.baseten.co) and choose [**API keys**](https://app.baseten.co/settings/api_keys) under **Organization settings** in the sidebar.
    2. Choose **Create API key**.
    3. Enter a name for the key (lowercase letters, numbers, and hyphens only).
    4. Select **Organization**, labeled **API key management**.
    5. Choose **Create API key**.

    To script creation, use the Management API procedure below with type `WORKSPACE_MANAGE_API_KEYS`. The Baseten CLI can't create management keys.
  </Tab>
</Tabs>

Copy the key immediately. You won't be able to view it again.

**To create a key from the Baseten CLI**:

Sign in with [`baseten auth login`](/reference/cli/baseten/auth#login), then
create a personal key, tied to your account and its permissions:

<CodeGroup>
  ```bash Command theme={"system"}
  baseten org api-key create --type personal --name <label>
  ```

  ```txt Output theme={"system"}
  Save this key now. It will not be shown again.
  abcd1234.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef01
  ```
</CodeGroup>

Create a team key, not tied to any one user and optionally scoped to
specific models:

<CodeGroup>
  ```bash Command theme={"system"}
  baseten org api-key create --type workspace-invoke --name <label> --model-id <model-id>
  ```

  ```txt Output theme={"system"}
  Save this key now. It will not be shown again.
  abcd1234.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef01
  ```
</CodeGroup>

See [`baseten org api-key`](/reference/cli/baseten/org-api-key) for the
other key types (`workspace-manage-all`, `workspace-export-metrics`).

**To create a key from the Management API**:

Creating a key over the API requires an existing key, so create your first
one in the console or CLI. To create a `WORKSPACE_MANAGE_API_KEYS` key,
authenticate with an organization Admin's personal key. The `type` value is uppercase here.

Supported types: `PERSONAL` | `WORKSPACE_MANAGE_ALL` | `WORKSPACE_INVOKE` | `WORKSPACE_EXPORT_METRICS` | `WORKSPACE_MANAGE_API_KEYS`

<CodeGroup>
  ```bash Request theme={"system"}
  curl -X POST "https://api.baseten.co/v1/api_keys" \
    -H "Authorization: Bearer $BASETEN_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"type": "PERSONAL", "name": "<label>"}'
  ```

  ```json Response theme={"system"}
  {"api_key": "abcd1234.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdef01"}
  ```
</CodeGroup>

See the [create API key endpoint](/reference/management-api/api-keys/creates-an-api-key)
for the full request options.

## Use API keys with the CLI

The first time you run `truss push`, the CLI prompts you to choose how to authenticate. Choose **Paste an API key** to use a key from this page, or **Log in via browser (OAuth)** to authenticate without a long-lived secret on disk:

```
$ truss push
💻 Let's add a Baseten remote!
? How would you like to authenticate?
  Paste an API key
> Log in via browser (OAuth)
```

You can also log in ahead of time with `truss login` (or its alias `truss auth login`). For details on credential storage, OAuth, and managing multiple remotes, see [`truss auth`](/reference/cli/truss/auth).

To configure or update an API key manually, edit `~/.trussrc`:

```sh theme={"system"}
[baseten]
remote_provider = baseten
api_key = YOUR_API_KEY
```

The [Baseten CLI](/reference/cli/baseten/overview) reads `BASETEN_API_KEY`
from the environment, or a stored profile from
[`baseten auth login`](/reference/cli/baseten/auth#login).

## Use API keys with endpoints

Set your key as an environment variable, or store it in your secret manager:

<CodeGroup>
  ```bash macOS/Linux theme={"system"}
  export BASETEN_API_KEY="paste-your-api-key-here"
  ```

  ```powershell Windows theme={"system"}
  setx BASETEN_API_KEY "paste-your-api-key-here"
  ```
</CodeGroup>

Pass your API key in the `Authorization` header using the `Bearer` scheme:

```sh theme={"system"}
Authorization: Bearer $BASETEN_API_KEY
```

`Bearer` works with OpenAI-style clients and AI gateways such as LiteLLM and OpenRouter without extra configuration. Baseten also accepts the legacy `Api-Key` scheme on every endpoint, so existing scripts using `Authorization: Api-Key <key>` continue to work:

```sh theme={"system"}
Authorization: Api-Key $BASETEN_API_KEY
```

For runnable examples, see [Call your model](/inference/calling-your-model).

<Note>
  [Frontier Gateway](/frontier-gateway/get-started) federated API keys are the exception: they only accept the `Api-Key` scheme. Workspace API keys used to manage gateway groups still accept either scheme.
</Note>

## Manage API keys

The [API keys page](https://app.baseten.co/settings/api_keys) shows all your keys with their creation date and last used timestamp. Use this information to identify unused keys.

### View and revoke keys as an organization Admin

Organization Admins see every key in the workspace: all team API keys plus every member's personal API keys. The **Owner / Team** column shows who each key belongs to: the owning member for personal keys, or the team for team keys. Use the **Member**, **Team**, and **Type** filters to narrow the list.

Organization Admins can revoke any key in the workspace, including other members' personal keys. Admins can't rename other members' personal keys. To see who created a team API key, check the [audit log](/organization/audit-logs).

All other roles see their own personal keys and any team keys they created. [Team Admins](/organization/teams#roles-and-permissions) also see every key scoped to their teams.

The [list API keys endpoint](/reference/management-api/api-keys/lists-the-users-api-keys) follows the same visibility rules. Each personal key in the response includes an `owner` object with the owning member's `user_id`, `email`, and `name`, so Admins can tell whose key each one is. [API key management keys](#api-key-management-keys) see and can revoke team and personal keys across the organization, which makes them the right credential for automated key hygiene.

### Rename, rotate, or revoke keys

API keys don't automatically expire. To maintain security, rotate keys periodically and revoke any that are no longer in use.

To rename a key, select the pencil icon next to the key name.

To rotate a key, create a new key, update your applications to use it, then revoke the old key.

To revoke a key, select the trash icon next to the key. Revoked keys cannot be restored.

You can also revoke a key programmatically, by its visible prefix:
[`baseten org api-key delete --prefix <prefix>`](/reference/cli/baseten/org-api-key)
from the CLI, or the
[delete API key endpoint](/reference/management-api/api-keys/delete-an-api-key).

### Security recommendations

* Store API keys in environment variables or secret managers, not in code.
* Never commit API keys to version control.
* Use [environment-scoped keys](#environment-scoped-api-keys) to limit access to specific environments and models.
* Use team keys with minimal permissions for production applications.
* Rotate keys periodically and revoke unused keys.
* Monitor key creation, deletion, and use through the [audit log](/organization/audit-logs).