API keys authenticate software, never people. The API keys page lists every key of the organization and lets you create and revoke them. There are two kinds: a gateway key lets one agent call tools through the Gateway, and a management key lets a script call the Cloud API with the scopes you choose.
You need a gateway key for every agent you connect. You need a management key only if you automate the Cloud API from your own scripts.
Who can see and use this page
The page is in the navigation for owners, admins and developers. Approvers and viewers do not see it, and the Cloud API refuses their requests if they open it by URL.
| Role | Sees | Creates | Revokes |
|---|---|---|---|
| Owner, admin | All keys | Gateway and management keys | Any key |
| Developer | Gateway keys only | Gateway keys | Any gateway key, whoever created it |
| Approver, viewer | Nothing (page refused) | No | No |
See Roles and permissions for the full role matrix.
Gateway keys and management keys
| Gateway key | Management key | |
|---|---|---|
| Used by | One agent's MCP client | Your scripts and automation |
| Presented to | The Gateway | The Cloud API |
| Bound to | Exactly one agent | No agent |
| Permissions | The agent's policy and delegation decide every call | The scopes chosen at creation |
| Created by | Owners, admins, developers | Owners and admins |
A gateway key is never accepted by the Cloud API, and a management key is never accepted by the Gateway. A gateway key also stops working while its agent is disabled.
Management key scopes
A management key carries one or more of these scopes. It can do nothing outside them.
| Scope | Allows |
|---|---|
read | Read organization data: the organization, agents and their delegations, tools, MCP servers, policies (including validation, simulations and reports), actions, observe windows, overview, usage and billing status |
approvals:read | Read approval requests |
receipts:read | Read receipts and download evidence bundles |
agents:write | Create and edit agents, end observe windows. Switching an existing agent's policy needs a signed-in owner or admin |
tools:write | Register, edit and delete MCP servers and create tools, with a developer's limits: new tools stay disabled, and only a signed-in owner or admin enables or authorizes them |
policies:write | Create policy drafts, set the shadow version, edit test examples, save simulations |
No scope lets a key decide approvals, cancel actions, list members, manage members, invitations, keys or webhooks, read the audit log, change settings, change the plan, activate or roll back policies, start observe windows or submit delegations. Those always need a signed-in person.
Environment: live or test
Every key is created in the Live or Test environment (Live by default). The environment is part of the key itself (kb_live_… or kb_test_…) and is recorded on every action made with it.
The environment does not sandbox anything. A test key calls the same tools, upstreams and credentials with the same policy as a live key, and its calls count against the plan the same way. What differs is how calls are filtered and how observe windows apply: a window relaxes only the calls of the environments it covers. Every window, a test-only one included, needs the owner's live opt-in (see Settings).
Create a key
Open the form
Go to API keys and select New API key. On an agent's page, Create a gateway key opens the same form with that agent already chosen.
Choose the kind
Owners and admins choose Gateway key or Management key. Developers create gateway keys only, so the choice is not shown to them.
Fill in the fields
- Name: where the key is used, for example
support-agent-prod(up to 200 characters). - Environment: Live or Test.
- Agent (gateway keys): the agent this key authenticates. If the organization has no agent yet, create one first. The menu lists at most 100 agents.
- Scopes (management keys): at least one;
readis preselected. - Expires (optional): leave it empty for a key that does not expire. A time must be in the future.
- Name: where the key is used, for example
Create and copy the key
Select Create key. The full key is shown once, in a notice titled with the key's name. Copy it into your agent's secret store, then select I have stored it — hide.
For a gateway key, the notice also shows the Gateway's MCP endpoint (
<gateway-url>/mcp) with a copy button. The agent's MCP client sends the key to that endpoint as its bearer token. The notice also shows the Gateway KID with a copy button: the identity that signs receipts, to pin when you verify a receipt. If the notice says instead that the dashboard does not know the Gateway's address, or shows no Gateway KID, contact K-Block support for the Gateway URL and the Gateway KID.
To connect an agent with its gateway key, follow Set up an agent.
The key list
Each row shows:
- Key: the name, the recognisable prefix
kb_<environment>_<prefix>_…(useful to find the key in logs and secret stores) and the creation date. - Kind: Gateway (with a link to its agent) or Management (with its scopes).
- Last used: when the key last authenticated (updated at most once a minute), or Never.
- Status: Active, Revoked or Expired, with the revocation time, the expiry time or No expiry.
With more than one key, a summary line counts active, revoked and expired keys and active keys in the test environment.
Revoke a key
Select Revoke on the key's row and confirm. Requests with the key fail at once: the Gateway answers 401 to an agent using a revoked gateway key. Revoking cannot be undone, and an already revoked key cannot be revoked again. Every revocation is recorded in the audit log as api_key.revoked.
Keys depend on the person who created them
A key works only while the member who created it is still an enabled member whose role may create that kind of key. K-Block checks this every time the key is used, and it also revokes keys when membership changes:
- When a member is removed or leaves, every key they created in the organization is revoked.
- When a member's role changes, the keys they created that the new role may not create are revoked. A developer who becomes a viewer loses their gateway keys; an admin who becomes a developer loses their management keys but keeps their gateway keys.
The dashboard does not warn about this when you change a role or remove a member. Before you do either, check which production agents use keys that person created, and create replacement keys first. See Members.
Limits
The number of keys that are not revoked is limited by the organization's plan (5 on the free Developer plan). Expired keys still count until you revoke them. Creating a key over the limit fails with PLAN_LIMIT_EXCEEDED; see Billing.