AI Gateway Security Keys
AI Gateway Security Keys are scoped API credentials that authenticate application and user requests to the gateway, controlling which workspace resources each caller can access without exposing raw provider API keys.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma AIRS AI Gateway (Americas region)
|
- AI Gateway activated
- Workspace manager or organization admin role in Strata Cloud Manager
|
AI Gateway Security Keys eliminate the risk of sharing
raw provider credentials by creating a managed, workspace-scoped authentication layer.
Applications authenticate to the AI Gateway using dedicated gateway API keys, while the
gateway securely handles provider authentication internally. Managed in Strata Cloud Manager
under
AI Security >
AI Gateway >
Security Keys, this structure allows you
to safely scope, monitor, and revoke access per application without disrupting other
services.
The Security Keys section shows Gateway API Keys, divided into two tabs:
- Service — Keys issued to automated processes, backend services, and CI/CD
pipelines. Service keys are designed for non-human callers that need persistent,
programmatic access to the workspace's LLM integrations. In addition to making
inference requests, service keys can also create, update, rotate, and delete other
workspace API keys, making them suitable for key lifecycle automation.
- User — Keys associated with individual human users within the workspace.
User keys carry the same inference and resource-access permissions as service keys,
but they cannot manage other API keys. Use user keys for personal access, developer
tooling, and user-level integrations where tying activity to a specific person is
important for audit purposes.
Both key types are sent in the x-portkey-api-key header when calling
the AI Gateway endpoint. The key identifies the workspace and authorizes the request
against that workspace's configured LLM integrations, budget limits, rate limits, and
guardrail policies. Keys can be rotated or revoked at any time without affecting other
workspaces or requiring changes to provider credentials.
For a complete reference of permission scopes available to service and user keys, and
guidance on creating and rotating keys programmatically via the Admin API, see the
Security Keys documentation.
