Docs/Administration/Api Keys

API Keys

ANTS Platform has two kinds of API key:

Key	Where	Used for
Project API key	Project Settings → API Keys	SDKs, OpenTelemetry exporters and the public REST API for one project.
Organization API key	Organization Settings → API Keys	The organization Admin API (projects, project keys, memberships) and SCIM provisioning.

These are separate from LLM connections, which let the platform call model providers, from Budget AI keys, and from the enrollment keys of the Discover AI agents.

Who can manage keys

Project keys need the integrations.apiKeys:admin permission. Among the built-in roles only the Owner has it. A custom role can grant it through Integrations & service accounts → Project API keys.
Organization keys need organization:CRUD_apiKeys (Owner only) and the admin-api entitlement (Enterprise plans). The tab is also hidden unless the deployment sets NEXT_PUBLIC_HIDE_ORGANIZATION_API_KEYS_SETTINGS to false, and it is hidden by default.

A key pair

Each key has two parts:

Part	Format	Use
Public key	`pk-ap-...`	Identifies the key. Sent as the username in HTTP Basic auth.
Secret key	`sk-ap-...`	The credential. Sent as the password. Shown in full only once.

ANTS Platform stores only a hash of the secret key. The list shows a masked form, so a lost secret cannot be recovered. Create a new key instead.

Create a key

Create

Select Create API keys. There is no form. The key is created at once.

Copy the secret

The sheet shows the Secret Key, the Public Key and the Host to send data to. Project keys also show a quick start snippet. Copy the secret key now. It cannot be retrieved later.

Add a note

Back in the list, select Add note to record what the key is for, such as the service or environment that uses it.

Configure your client

Set the keys and host in your SDK or exporter. See Sending Data In.

If step-up verification is enabled on the deployment, creating a key first asks you to enter a code sent to your email. See Authentication & Security.

The key list

Column	Meaning
Created	When the key was created.
Note	Your description. Editable.
Public key	The full public key.
Secret key	A masked form of the secret.
Agents	Project keys only. The agents that have sent data with this key, with first seen and last seen times in the tooltip. Shows No activity recorded until the key is used.
Expires	The expiry date, the days left when 14 or fewer remain, Expired, or Never for older keys created before expiry existed.

There is no last-used time.

Expiry

Project and organization keys expire 6 months after creation. You cannot choose a different period.
Requests with an expired key are refused with 401.
Owners are emailed and notified in the app 30, 14, 7 and 1 days before a key expires. See Notifications.

Rotate and delete

There is no rotate action. To rotate a key, create a new one, update your clients, then delete the old one with the trash icon and confirm Permanently delete. A deleted key stops working within a few minutes, once the authentication cache refreshes.

Creating a key, changing its note and deleting it are recorded in Audit Logs.

Ingestion-only project keys

A deployment can set PROJECT_API_KEYS_INGESTION_ONLY=true. Project keys can then only send traces, fetch prompts and check authentication. Calls that read or delete data return 403. The create sheet shows Trace ingestion only. Organization keys are not affected.

What organization keys can do

With the admin-api entitlement, an organization key can:

List the organization's projects, and create, update and delete projects.
List, create and delete project API keys.
List and update organization memberships, and project memberships (project memberships also need the rbac-project-roles entitlement).
Provision users through SCIM.

Organization keys cannot read project data such as traces, and they only work with HTTP Basic auth. Keys have no finer-grained scopes.

⚠

Treat secret keys like passwords. Never commit them to source control or put them in browser code. Use one key per service or environment so you can delete one without affecting the rest.

Next steps

Sending Data In: use keys to send traces.
API Reference: authenticate REST calls.
SCIM Provisioning: use an organization key with your identity provider.