> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Management Keys

> Create workspace-scoped management keys in Orq.ai to authenticate admin operations on API keys, budgets, projects, and workspace settings.

## Overview

<Info>
  Management Keys are only available to workspace admins. The **Management Keys** page is not visible to non-admin members.
</Info>

**Management Keys** are workspace-scoped tokens for authenticating workspace administration operations. They can manage **API keys**, **Budgets**, **Projects**, **Smart Routers**, **Evaluators**, **Workspace models**, and **Workspace Settings**.

<Tip>
  Management Keys cannot be used to query models or agents. Use a standard [API Key](/ai-studio/organization/api-keys) for inference and product endpoints.
</Tip>

### Use cases

* Automating workspace provisioning via the API.
* Delegating API key rotation to a deployment pipeline without granting full admin access.
* Letting a billing automation script read and update Budgets without exposing API key management.

### Workspace administration endpoints

Standard API keys are project-scoped. Use a Management Key for these workspace administration endpoints:

| Endpoint family | Management Key access |
| - | - |
| `/v2/api-keys*` | List, retrieve, create, update, and delete API keys. `/v2/api-keys/capabilities` is public. |
| `/v2/budgets*` | List, retrieve, create, update, reset, and delete Budgets. |
| `/v2/projects*` | Manage Projects across the workspace. A project-scoped API key can only list or retrieve its selected Project. |
| `/v2/smart-routers*` | List, retrieve, create, update, enable, disable, and delete Smart Routers. |
| `/v2/evaluators*` | List, retrieve, create, update, and delete Evaluators. |
| `/v2/workspace-settings` | Retrieve or update Workspace Settings according to the key capability. |

Notifiers are intentionally not listed here: their routes are project-scoped and do not require a Management Key. Project-scoped API keys can access the Notifiers API for their selected project.

## View Management Keys

Navigate to **Settings** → **Organization** → **Management Keys** to view all keys in the workspace.

<Frame caption="The Management Keys list showing key name, status, permission mode, and creator.">
  <img src="https://mintcdn.com/orqai/K6sTaJb5h4tCQHNp/images/management-key-overview-411.png?fit=max&auto=format&n=K6sTaJb5h4tCQHNp&q=85&s=97564ebb62278b7db50badb166b3392c" alt="Management Keys list with columns for Created date, Name, Status, Permissions, and Created by." width="1446" height="721" data-path="images/management-key-overview-411.png" />
</Frame>

Click any row to open the edit panel and update the key's name, permissions, or expiration date. Hover a row and click <kbd><Icon icon="ellipsis" /></kbd> for additional options:

* <kbd><Icon icon="pencil" /> Edit</kbd>: open the edit panel to update the key's name, permissions, or expiration date.
* <kbd><Icon icon="copy" /> Duplicate</kbd>: create a new key with the same permissions.
* <kbd style={{ color: 'red' }}><Icon icon="trash" color="red" /> Delete</kbd>: permanently remove the key from the workspace.

## Create a Management Key

<Steps>
  <Step title="Open the creation panel">
    Navigate to **Settings** → **Organization** → **Management Keys** and click <kbd><Icon icon="plus" /> New key</kbd>.

    <Frame caption="The Create new key dialog with fields for name, permissions, per-capability access, and expiration date.">
      <img src="https://mintcdn.com/orqai/K6sTaJb5h4tCQHNp/images/management-key-create-411.png?fit=max&auto=format&n=K6sTaJb5h4tCQHNp&q=85&s=4fc647d11105b51d1f7ca5a273729b4c" alt="Create new key dialog showing Name field, Permissions toggle with All, Restricted, and Read only options, API keys and Budgets capability rows, and an Expiration date field." width="815" height="752" data-path="images/management-key-create-411.png" />
    </Frame>
  </Step>

  <Step title="Enter a name">
    Enter a **Name** for the key (required, max 128 characters).
  </Step>

  <Step title="Set permissions">
    Select a **Permissions** mode, default is All. See [Permission modes](#permission-modes) below.
  </Step>

  <Step title="Set expiration (optional)">
    Set an **Expiration** date if the key should stop authenticating after a certain date.
  </Step>

  <Step title="Create and copy the key">
    Click <kbd>Create key</kbd>. A **Save your key** panel appears showing the token.

    <Warning>
      The token is only shown once. Store it securely before closing this panel. It cannot be retrieved afterwards.
    </Warning>
  </Step>
</Steps>

### Permission modes

| Mode | Description |
| - | - |
| **All** | Full read and write access to all capabilities. |
| **Restricted** | Configure access per capability. Each capability can be set to None, Read, or Write independently. |
| **Read only** | Read access to all capabilities. |

### Capabilities

| Capability | <Icon icon="shield-slash" /> None | <Icon icon="book-open" /> Read | <Icon icon="pencil" /> Write |
| - | - | - | - |
| **API keys** | No access. | List and view workspace **API keys**. | List, view, create, update, revoke, and delete workspace **API keys**. |
| **Budgets** | No access. | List and view workspace **Budgets**. | List, view, create, update, reset, and delete workspace **Budgets**. |
| **Projects** | No access. | List and view workspace **Projects**. | List, view, create, update, and delete workspace **Projects**. |
| **Smart Routers** | No access. | List and view workspace **Smart Routers**. | List, view, create, update, enable, disable, and delete workspace **Smart Routers**. |
| **Evaluators** | No access. | List and view workspace **Evaluators**. | List, view, create, update, and delete workspace **Evaluators**. |
| **Workspace models** | No access. | No list or view endpoints exist for workspace **models**; read access alone performs no API operations. | Enable and disable workspace **models** and manage their sharing. |
| **Workspace Settings** | No access. | View workspace settings. | View and update workspace settings. |

<Note>
  Management Keys are not available through MCP. Use the REST API to manage keys programmatically. See [Manage keys programmatically](/ai-gateway/configuration/api-keys#manage-keys-programmatically) for the key lifecycle, permission model, and SDK examples.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.