Issuing API keys

Feature set: Inference Contact our support for access.
This functionality evolves quickly, the behavior and APIs might change between releases without further notice.

An inference route refuses every request until a key authorizes it. Keys are issued per client, so any one of them can be revoked without disturbing the others.

Issuing a key

Name the client the key is for:

akka models routes keys add models production
API key for "production" on route "models":

  sk-EXAMPLE-KEY-DO-NOT-USE-xxxxxxxxxxxxxxxxxxxx

This is the only time it is shown. Store it somewhere safe.

Copy the key now. Keys cannot be read back.

Listing the clients that hold a key

akka models routes keys list models

This shows which clients hold a key, never the keys themselves.

Rotating a key

Every key in the list works until it is removed, so a rotation has no cutover. Add the new key, move the clients across, and then remove the old one:

akka models routes keys add models production-2
akka models routes keys remove models production

Deleting a route does not revoke the keys issued against it. Rebuild the route under the same name and every key ever issued to it works again. A key you meant to retire is only gone once akka models routes keys remove has removed it.

Diagnosing a rejected request

Message Cause

api key authentication failure: no API Key found

The request carries no Authorization header, or the header is missing the Bearer prefix.

api key authentication failure: invalid credentials

The key is not one this route accepts. akka models routes keys list shows which clients hold one. Issue a fresh key if the value was lost.

 

The features described in this section are an add-on to Akka Automated Operations. They are not included in the base product.

See also