Key types
Management routes accept only
phaseo_v1_mk_<kid>_<secret>. Gateway API keys
use phaseo_v1_sk_<kid>_<secret> and are inference-only; they cannot access
control-plane endpoints.
Use management keys only from server-side code:
Choose an access level
The dashboard offers explicit templates. Each template expands to the listed capabilities when the key is created; Phaseo never stores a wildcard such asall. A key therefore cannot gain a newly introduced permission implicitly.
Capability reference
Use an access template for common cases. Use explicit capabilities when an integration needs a smaller, purpose-built grant.Write templates include the matching read capabilities so an integration can
inspect a resource before updating it. All includes delete capabilities; use
it only for trusted administrative automation.
Scopes and workspace roles
A scope is necessary but not sufficient. Phaseo also verifies the key or OAuth principal belongs to the requested workspace and has the required workspace role. A scoped key cannot use a capability to access another workspace or bypass ownership and administrator checks. For example,keys:write authorizes key-management operations, while the
workspace role check determines whether the caller may manage keys in that
workspace.
Guardrails are different
Guardrails apply to gateway API keys and govern inference traffic: routing restrictions, budgets, prompt-injection handling, and sensitive-information rules. Management-key scopes govern which administration APIs a credential may call. They are complementary controls, not substitutes. See Roll out guardrails on API keys for an inference-key guardrail rollout.Security and rotation
- Keep management keys out of browsers, desktop logs, source control, and chat.
- Use one purpose-built key per integration and prefer the narrowest template.
- Give keys an expiry where the integration does not need indefinite access.
- Pause or delete unused keys immediately.
- Rotate a leaked key before investigating the incident further.