Authentication

Every request to the AI Gateway carries a bearer token. This page covers creating, rotating, and revoking that token, the cap on how many you can hold, and how to keep one safe.

Creating a key

In the dashboard, open AI Gateway → API Keys and create a key. It starts with sk-sc-, and the full value is shown exactly once, at creation — copy it before you navigate away, because the dashboard never displays it again.

Rotating a key

There’s no in-place rotation — create a new key, switch your app to it, then revoke the old one. Because both keys work at once during the switch, you can roll a key without a gap in service.

Revoking a key

Revoke a key the moment it’s no longer needed, or the moment you suspect it leaked. Revocation is immediate: any request bearing that key starts failing authentication right away.

The per-account key limit

An account can hold up to 25 active keys at a time. Revoke keys you’re not using to free a slot — there’s no other way to raise the cap.

Handling keys safely

Treat a gateway key like any other production credential: keep it in an environment variable or the Secrets Vault, never in source control, and never in a client-side bundle. Give each integration or environment its own key so a leak or a revocation only ever affects one thing.

Next

• AI Gateway quickstart — send your first request with a new key.
• Authentication reference — header format and error responses.
• Choosing a model — what a key can call once it’s created.