Skip to main content
Version: v1.3.x

Manage API Keys

This guide describes how to create, copy, edit, revoke, and delete API Keys for PaletteAI Inference Launchpad. An API Key is a bearer credential that a client presents to the Inference Launchpad gateway and that draws against exactly one Inference Quota.

You can manage API Keys at the System, Tenant, or Project scope, from the same Inference Quotas tab you use to manage quotas.

You can manage API Keys from the PaletteAI console or by applying YAML Kubernetes manifests.

Prerequisites​

  • An Inference Quota exists at the target scope. Refer to Manage Inference Quotas.

  • Depending on the scope you plan to manage:

  • The spectrocloud.com/inferenceapikeys:create, spectrocloud.com/inferenceapikeys:update, and spectrocloud.com/inferenceapikeys:delete permissions for creating, editing, and deleting keys, and spectrocloud.com/inferenceapikeys:get for copying key values. If a button described in this guide is not displayed, your role does not include the required permission.

Create an API Key​

Each API Key is bound to one Inference Quota at creation. The binding is immutable — to move a key to a different quota, delete it and create a new one.

  1. Log in to the PaletteAI console and navigate to the settings page for the target scope:

    • System — System Settings
    • Tenant — Tenant Settings
    • Project — Select the Project, then Project Settings

  2. Select the Model Management section, and then select the Inference Quotas tab.

  3. In the row for the quota you want the key to draw against, select API Keys to open the API Keys drawer.

  4. Select Add API Key in the drawer's toolbar. The Add API Key dialog appears.

  5. In the Name field, enter a name for the key. The name is displayed in the drawer and on the key resource, and it cannot be changed later. Names must be 63 characters or fewer, contain only lowercase alphanumeric characters or hyphens, and begin and end with an alphanumeric character.

  6. In the Expiration field, select one of the following:

    • Never — The key does not expire on its own.
    • 7 days, 30 days, 60 days, or 90 days — The exact date each option resolves to is displayed in the option label.
    • Custom — A Custom Date field appears. Pick any future date.

  7. In the OIDC Groups field, select the groups that may view and manage this key in PaletteAI. If a group is not in the list, type the name and press Enter to add it. At least one group is required. These groups do not affect gateway authentication.

    If the current scope has parent-scope API keys with their own groups, those appear as a read-only Inherited OIDC Groups section — members of those groups already have control-plane access through the parent-scope key.

  8. Select Confirm. The new key appears in the drawer.

Copy the API Key Value​

The key value is generated by the controller and stored in a Secret. You must copy it out and hand it to the caller through a secure channel; the UI does not persist the value.

  1. On the Inference Quotas tab, in the row for the quota, select API Keys to open the drawer.

  2. In the row for the key you want to copy, select the copy icon in the API Key column. The value is placed on your clipboard.

The value begins with the prefix pai-. Callers pass it to the Inference Launchpad gateway as a bearer token in the Authorization header. Refer to the PaletteAI Inference Launchpad documentation for the request format.

Edit an API Key​

You can update the OIDC groups and expiration on an existing key in place. The key name and the Inference Quota it draws against cannot be changed. To change either, delete the key and create a new one.

  1. On the Inference Quotas tab, in the row for the quota, select API Keys to open the drawer.

  2. In the row for the key you want to edit, open the three-dot menu and select Edit. The Edit API Key dialog appears with the current values pre-filled.

  3. Update the Expiration or the OIDC Groups fields.

  4. Select Confirm.

Delete an API Key​

Deleting a key permanently removes the credential and its Secret. Any client still using the value receives an authentication error from the gateway on the next request. This action cannot be undone.

  1. On the Inference Quotas tab, in the row for the quota, select API Keys to open the drawer.

  2. In the row for the key you want to delete, open the three-dot menu and select Delete.

  3. In the confirmation dialog, select Confirm.

Validate​

Confirm the key is working:

  1. On the Inference Quotas tab, open the API Keys drawer for the quota and confirm the key appears with the Active status badge.

  2. Issue an inference call using the copied key value. Refer to the PaletteAI Inference Launchpad documentation for the request format.

  3. Return to the Inference Quotas tab and confirm the utilization on the quota row advances after the call.

If a call is rejected by the gateway, verify that the bearer token is correct, that the key is not Expired or Revoked, and that the referenced Inference Quota still has budget remaining in the current window. If a user cannot see or copy a key in the PaletteAI console, verify that they belong to at least one of the key's OIDC groups (including any inherited from a higher-scoped key).

Next Steps​