API Keys

An API key authenticates your requests and carries grants — the precise set of objects it may reach, and what it may do with each. A single key can invoke a model, read and write a RAG, or any combination you need.

Grants

Each grant pairs an object with an action:

Object	Actions
Model (in-cluster or external)	invoke
Model alias	invoke
RAG	read, write

You can only grant access you already hold, and grants are fixed at creation — to change what a key can reach, create a new one.

Alias or model

An alias is a stable public name that an administrator points at a model, and can point at another model later (see Model Gateway). You can grant a key on the alias, or on the model behind it:

• Grant on the alias — the key follows the alias. When an administrator points the alias at another model, the key keeps working and your requests go to the new model. Pick this when your code calls the alias name.
• Grant on the model — the key stays with that one model, even if the alias later points somewhere else. Pick this when you always need the same model.

An alias is offered only if you may use it yourself.

Personal and service-account keys

• A personal key acts as you: it inherits a subset of your own permissions and is bound to your identity, so it stops working if you lose access. Reach for it for your own scripts and integrations. Any tenant member can create one.
• A service-account key stands on its own, independent of any user, and keeps working as people come and go. Use it for shared and production workloads. Only tenant admins can create one.

Creating a key

Create keys from the API Keys page in the portal. Every service's detail view also has a Create API key link that opens the form with the matching grant already filled in — the quickest way to scope a key to a single model or RAG.

Under Resource type, choose Model Alias to grant the key on an alias. It is already selected when there are aliases you can use. If you pick a model that an alias points at, the form tells you and offers a Use <alias> button that moves the grant to the alias. Keep your own choice to tie the key to that one model.

The key is shown once, at creation. Copy it then; it can't be retrieved later. Only a short prefix (e.g. cm_api_3f9a…) is kept, so you can still recognize the key in the list.

Rotating and revoking

• Rotate issues a fresh secret while the old one keeps working for a short overlap window — swap the new secret into your clients with no downtime, and the old one stops working once the window closes.
• Revoke disables the key immediately and permanently.

Checking usage

Portal v2

Open a key from the API Keys page to see how much it has been used. The detail page shows a Tokens over time chart followed by Token usage totals for total, input, output, embedding, and rerank tokens.

The chart opens on the last two hours. Use From and To to choose another period. While To reads Now, the chart keeps refreshing; choose a date and time there to stop at that moment. The chart and totals cover the same selected period. In the totals summary, Total tokens adds input, output, embedding, and rerank tokens. Select a token name above the chart to hide or show its line.

You can view usage for your personal keys. Tenant administrators can also view usage for the tenant's service-account keys.

Legacy portal

Click a key's name on the API Keys page to open it. The API key usage panel lets you select Last 2 hours, Last 24 hours, Last 7 days, Last 30 days, or a custom start and end.

The chart draws prompt, completion, total, embedding, and rerank tokens for the selected range. Select a token type above the chart to hide or show its line, or drag across the chart to narrow the range. Token usage totals below the chart repeats the values as one row; its Total tokens value adds prompt, completion, embedding, and rerank tokens.

If the key was not used during the selected range, the page reports that no API key usage data is available.

Using a key

Send the key as a bearer token to the Model Gateway:

curl -sS "https://api.<your-domain>/v1/responses" \
  -H "Authorization: Bearer cm_api_…" \
  -H "Content-Type: application/json" \
  -d '{"model": "qwen3-6-27b-fp8", "input": "Hello"}'

Store keys as secrets — never in client-side code or version control.