Summary

API keys in Braintrust automatically inherit the permissions of the user who creates them. This means you can control what API keys can access by managing user permissions through permission groups.

While there is no dedicated permission to restrict who can create API keys, you can limit their scope and capabilities through the existing permission system.

Features used

Permission Groups:

Define what users can access at the organization and project level. API keys automatically inherit the permissions of the user who creates them, so controlling user permissions through groups automatically controls what their API keys can do.

Service Accounts:

Organization-level keys that can only be created by org administrators. These provide broader permissions for automation and shared tools, while regular users are limited to creating keys with their own permission level.

How-to

1. Configure permission groups to define user access

• Go to Settings > Project Permissions > Permission Groups

• Create or edit permission groups based on user roles

• Assign users to the appropriate permission group based on what they should be able to access.

• Make sure you configure both organization-level and project-level permissions for each group. This will define the scope of any API keys those users create.

2. Understand API key permission inheritance

• When a user creates an API key, that key inherits all of the creator's permissions

• The key can only access projects and resources the user has access to

• Keys cannot escalate privileges beyond what the creator has

• If you reduce a user's permissions, their existing API keys are also restricted

  • This means you don't need a separate permission to control API keys - controlling user access automatically controls their keys.

3. Use service accounts for shared automation

• For organization-wide automation or shared tools, have org administrators create service account keys

• Go to Settings > Project Permissions > Service Accounts

• Create a service account key (only available to org admins)

• Distribute this key to your team for shared use cases

• This centralizes control over automation credentials instead of having multiple users create individual keys.

Relevant Link:

• Access Control