Personal API keys

Control who can create personal API keys, monitor their usage, and revoke keys across your workspace.

Personal API keys let members use your workspace's models from coding tools and their own projects, without you handing out a shared workspace key. Each key belongs to the member who created it, reaches the completion endpoints only, and spends that member's usage budget, so you decide who gets access and how much they can spend.

Give members access

Open the personal API key settings

Go to Settings > Workspace > Products > API, then open Personal API keys.

Choose who gets access

Open access to the whole workspace, or keep it to the people who need it:

Turn on General access so everyone in the workspace can create a personal API key.

Leave General access off and turn on Allow specific members or groups to create personal API keys, then add the members and groups that need it.

Give them budget to spend

Personal API usage draws on the same budget as the member's chat and agent usage. Under Settings > Workspace > Usage, enable extra usage and set an effective limit above zero for each member you granted access. Make sure the workspace spend limit also has room for personal API usage.

A member with access but no available budget can still open the personal API key page, but cannot create a key. Personal API requests return an error instead of using a fallback model when the member's effective budget is exhausted. If usage requests are enabled, they can ask for a higher individual limit right there. If the workspace spend limit is reached, increasing the member's limit does not restore API access. Personal API requests continue to return an error until you raise the workspace limit, set it to Unlimited, or wait for the current billing period to reset.

Monitor usage and revoke keys

Usage insights shows API spend for the current month, how many keys are active, how many members hold one, and daily spend per member over the last 14 days.

All personal keys is where you review individual keys. Search by member, filter by spend or activity, check each key's owner, last use, monthly spend, and status, and revoke a key when you need to.

Revoking takes effect immediately and cannot be undone. A personal key also stops working when you take away a member's access to personal API keys or deactivate their workspace membership.

When should I use a personal key?

Reach for a personal API key when one member needs API access under their own identity and usage budget. Use a workspace API key for shared applications and automations that should not depend on one person's account.

A workspace API key runs as a service account. It does not use the personal connections of the person who created it. For agents called with a workspace API key, preselect a connection or share the connection with that key. If an action is not available to the entire workspace, share that action with the key.