---
title: "AI Tool Keys"
slug: ai-keys-admin
section: In-App Help
status: stable
description: "Restricted"
last-updated: 2026-10-07
---

# AI Tool Keys

Restricted

Enter the admin password to continue.

Admin password

Unlock

return (

# AI Tool Keys

Staff-only console for issuing and revoking the AI Consumer keys consumed by the /api/ai/v1/* surface (ChatGPT Custom GPTs, Manus, Cursor, etc.). Backed by /api/ai/keys.

Lock

## Overview

> **Tokens are shown once**
>
> New tokens are generated server-side and returned exactly once at creation time. They are never stored or displayed again — only an 8/4 preview slice is shown in the list below. If a token is lost, revoke the key and issue a new one.

## Issue a New Key

New AI Consumer key

Label

2–64 characters, alphanumerics plus - or _. Identifies the tool, not a person — appears on every audit row as ai-consumer: .

Issuing… / Issue key

label / token

## Existing Keys

ve been locked back out. A 503 means AI_KEYS_ADMIN_PASSWORD isn

Loading… / $length key$s

Refresh

| Label | Token | Created | Last used | Status | Action |
| --- | --- | --- | --- | --- | --- |
| No AI Consumer keys have been issued yet. | | | | | |
| label | tokenPreview | | | | |

_(row above is a template, repeated for each data row)_

## Key Lifecycle

- Issue: server generates an aik_-prefixed token from 24 random bytes; full token shown once, preview stored thereafter.

- Use: AI tools send the token as either Authorization: Bearer or x-ai-key. Every authenticated request bumps Last used and writes an ai.* audit row.

- Revoke: takes effect on the next request — no restart needed. Revoked rows stay in the list for audit context. The label can be reissued once the prior key is revoked.

- Audit: issuance and revocation are recorded as ai_consumer_key.issued / ai_consumer_key.revoked in the Audit Console.

For the consumer-facing setup walkthrough (ChatGPT, Manus, rate limits, OpenAPI spec) see AI Connector.

Revoke AI Consumer key?

Cancel

Revoke key