- Masked key in the format
prefix•••••••last4 - Scopes — granted permissions (e.g.
models:read,chat:completions) - Created — provisioning time
- Last used — most recent request
Create
In Additional Gateway Keys, click Create key, name it (e.g.Production, CI/CD), and click Create key. Copy the full value immediately — it is shown once.
Reveal
The primary sandbox key is hidden by default. Click Reveal on the key card, then Copy. Only workspace admins can reveal it.Rotate
Click Rotate key on the primary sandbox card. This issues a new key, updates sandbox secrets, and revokes the old key. Plan rotations during low-traffic periods — gateway access briefly interrupts while the new key propagates.Revoke
In the Additional Gateway Keys table, click the menu (⋯) on the row, select Revoke key, and confirm. Revocation is immediate and permanent.Never share secrets
- Store keys in environment variables or a secrets manager.
- Never commit keys to source code, even in private repos.
- Use separate keys per environment (production, staging, dev).
- Rotate after team changes or suspected exposure.
Reference
Key types
Key types
- Primary sandbox key — auto-created with your workspace. Used by the cloud sandbox and the Dench desktop app. Can be revealed and rotated, but not deleted.
- Additional gateway keys — keys you create for specific integrations, CI/CD, or environments. Revoke when no longer needed.
Primary key card fields
Primary key card fields
Additional Gateway Keys table columns
Additional Gateway Keys table columns
| Column | Description |
|---|---|
| Name | The label you gave the key |
| Key | Prefix and last 4 characters |
| Created By | Workspace member who created the key |
| 30d Requests | Gateway requests in the last 30 days |
| 30d Cost | Estimated cost for those requests |
| Last Used | Time since last use |
| Status | Active or Revoked |
View usage
View usage
Click the menu icon on any key row and select View usage to see request counts and estimated cost over the last 30 days.