Who can create and manage API keys?

Last updated: November 3, 2026

It depends on the member's role. An administrator isn't required to create a key.

  • Developers can create API keys, and can deactivate or delete only the keys they created.

  • Admins can create, deactivate and delete all of the organization's API keys.

An organization can have more than one admin. Both roles can view usage statistics, including cost, in Settings → Usage.

Who can see and use a key

  • API keys belong to your organization, not to an individual user or service account.

  • Every member of the organization can see the organization's keys.

  • You can't restrict permissions or set a spend limit per key.

  • A key can't be created or reactivated while your organization has no available credits.

When someone leaves your team

Removing a member does not automatically revoke the keys they created. In the API keys section of the console, an admin can deactivate or delete those keys. SSO and SCIM aren't available yet, so nothing is revoked automatically through an identity provider.

Rotating keys

Keys don't expire, and automatic or scheduled rotation isn't supported. To rotate a key:

  1. Create a new key.

  2. Update your applications to use it.

  3. Deactivate or delete the old key.