AI Gateway Workspaces
Workspaces are logical containers in AI Gateway that scope LLM access, budgets, rate limits, and guardrail policies to a specific team or application.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma AIRS AI Gateway (Americas region)
|
- Prisma AIRS license with flex credits
- Strata Cloud Manager access
|
A workspace is AI Gateway's unit of isolation. When you create a workspace, the gateway
automatically generates a virtual key — a scoped API credential that grants access to
exactly the LLM integrations, models, and spending limits you define for that workspace.
Developers include the virtual key in the x-portkey-virtual-key request header.
Requests that arrive without a valid virtual key are rejected.
Each workspace maps to a specific use case, team, or application. For example, you might
create one workspace for your engineering team's internal chat assistant, another for a
customer-facing support bot, and a third for a batch processing pipeline. Each workspace can
have its own:
- LLM integrations — the providers and models available to that workspace
- Budget limits — a cost-based or token-based spending cap, with a configurable reset period
- Rate limits — request-per-minute and request-per-day ceilings to prevent runaway usage
- Model provisioning — an allowlist that restricts which models the workspace can call
Workspaces exist within an organization, which corresponds to your Strata Cloud Manager
tenant service group (TSG). The organization-level settings — such as LLM provider
integrations — are inherited by all workspaces, but each workspace can override rate and
budget limits independently.
Because all LLM traffic for a workspace passes through a single virtual key, you get unified
observability: every request logged in AI Gateway records which workspace made it, which model
was used, how many tokens were consumed, and what the request cost in flex credits.
