Skip to main content
A virtual key is what an application or a person sends to the AI Gateway instead of a provider’s API key. It tells Altrum who is calling and which rules apply. Because it is not a provider credential, a leaked key can be revoked in Altrum without touching your provider accounts.

​
Three kinds of key

Each key follows the rules of what it belongs to: the guardrails, budget, rate limit, model access and cache of the AI system, or of the organization for organization and personal keys. A key whose owner has no live guardrails shows Unguarded: nothing checks its requests until guardrails are applied. A key can also have its own budget, rate limit, providers and models. An expiry date is optional. A key with no providers chosen can use every provider your organization has stored a credential for.

​
Create a key

Open AI Gateway, then Virtual keys, and choose Create key. Name it, and optionally describe it, set when it Expires (never, in 30 or 90 days, or on a date), choose its Providers and models, its Limits and the MCP tools it may use. When your organization also uses Altrum’s governance, you can make it an AI system’s key from the start by choosing the AI system. Copy the key when it is shown: it is shown once and cannot be shown again. The list shows only its last four characters. Every key starts with sk-alt-.

​
Send it

Give the key to your SDK as its API key, and it sends it as a bearer token or in the header it always uses. You do not change your code beyond the base URL and the key. See Authentication and SDKs. A key that cannot be used is refused before anything reaches a provider:

​
Attach an organization key to an AI system

When you register the AI system an organization key’s traffic belongs to, attach the key to it with Attach to an AI system in the key’s menu (shown once your organization has AI systems). From the next request, the AI system’s guardrails, budget, rate limit and cache apply. Earlier requests in the log keep their organization attribution. A key can be attached once. It cannot be moved to another AI system or detached, and a personal key cannot be attached.
An AI system’s keys work only while it is Live. Attach a key to an AI system in Draft, In review or Approved and its requests are refused from the next one, with ai_system_inactive, until the AI system goes live. The dialog warns you when you pick one. To avoid an outage, attach the key once the AI system is live.
Discover lists the keys whose traffic belongs to no AI system, and attaches them from there: to an AI system you register from their traffic, or to one you already have.

​
Personal keys

An admin allows personal keys under AI Gateway, Settings, Access and sets what Each new personal key starts with: a budget, a request limit and the Allowed models. Until they do, My keys says: Your organization has not turned on personal keys. Ask an owner or admin to turn them on. The defaults are copied when a member makes a key, so changing them later does not change keys that exist. Admins can tighten any personal key. A personal key is still held to the organization’s own budget and limits. A personal key is also how Altrum knows who you are when an MCP tool needs your own account. See MCP tools. When a member is removed from the organization, or their account is disabled, their personal keys stop working. They are switched off, not deleted, and enabling the account again does not switch them back on: the member makes new ones.

​
When a key was last used

Virtual keys, My keys and an AI system’s AI Gateway tab show Last used for each key: the latest request or tool call made with it, or Never. A key nobody uses any more is one to revoke; an access review lists every key with it, its spend over 90 days and what looks wrong with it.

​
Rotate and revoke

Each key’s menu has Edit, Rotate, Switch off (or Switch on), Revoke and, for an organization key, Attach to an AI system. Rotate issues a new value for the same key, keeping its settings and history, and shows it once: “A new value is made and shown once. The old value stops working, so update everything that uses it.” Switch off refuses the key’s requests until it is switched on again. Revoke stops a key for good: “The key stops working straight away and cannot be brought back. Its requests stay in the log.” A member can rotate and revoke their own personal keys under AI Gateway, My keys; owners and admins can do the same for any key.