>
    Strata Copilot
    Manage Gateway API Keys
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Gateway
    4. AI Gateway Routing Configurations
    5. Manage Gateway API Keys
    Download PDF
    Prisma AIRS

    Manage Gateway API Keys

    Table of Contents

    Manage Gateway API Keys

    Create and manage AI Gateway API keys to authenticate application requests, and optionally attach a routing configuration so every request using that key.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS AI Gateway (Americas region)
    • AI Gateway activated
    • At least one LLM integration configured
    AI Gateway uses two types of credentials to authenticate requests: the gateway API key and the virtual key. The gateway API key (sent in the x-portkey-api-key header) authenticates the application or service making the request to AI Gateway. The virtual key (sent in the x-portkey-virtual-key header) identifies the workspace and grants access to that workspace's LLM integrations. Both headers are required for most requests.
    You can optionally attach a routing configuration to an API key. When a config is attached, every request that uses that API key automatically applies the config's load balancing, fallback, caching, or guardrail settings, regardless of whether the request body specifies a config explicitly. This lets you enforce a standard routing policy for an application without requiring the developer to reference a config in every call.
    Gateway API keys are scoped to one of three roles: organization service (ORGANISATION_SERVICE), workspace user (WORKSPACE_USER), or workspace service (WORKSPACE_SERVICE). Organization service keys have the broadest scope; workspace-scoped keys are limited to a single workspace.
    1. In Strata Cloud Manager, select AI SecurityAI GatewayAPI Keys and click Add API Key.
    2. In Name, enter a descriptive name for this key.
    3. For Key Type, choose the scope: Organisation Service, Workspace User, or Workspace Service.
    4. If you chose a workspace-scoped key type, select the target workspace from the Workspace list.
    5. (Optional) To attach a routing configuration, select a config from the Default Config list.
      When a config is attached, it takes effect for every request authenticated with this key. Inline configs passed in the request body are blocked when the Block Inline Configurations setting is enabled in AI Gateway settings.
    6. Click Save.
      The API key value is shown once and cannot be retrieved after you close the dialog. Copy it now and store it securely.
    7. Click Commit to apply the configuration.
      The gateway API key is ready. Applications send the key in the x-portkey-api-key header when calling the AI Gateway endpoint. Include a workspace virtual key in x-portkey-virtual-key to route the request to a specific workspace's LLM integrations.

    © 2026 Palo Alto Networks, Inc. All rights reserved.