Issue, rotate and revoke API keys
Issue a key for a service, choose what it may do, replace its secret and revoke it on the keys page of the console.
4 min read
An API key lets a service call Slen on behalf of one project. This page is about the keys page of the console. How a request uses a key is described in Authentication.
Where the keys are
Open Settings, then Keys & Access. The page lists the keys of the project chosen in the header. Choose another project there, and the list changes with it.
A key in the list shows its name, the last four characters of its secret, when it was last used, who created it and how many permissions it has. The time of the last use is kept to the minute.
The page opens for whoever has the management:read permission. Issuing, rotating and revoking need management:write. Without it the page is a list with no buttons.
Issue a key
1. Start a new key
Press New key.
2. Name the key
Give the key the name of the service that will use it. The name is what tells one key from another in the list. It can be up to 120 characters long.
3. Choose its permissions
Tick what the key may do. At least one permission has to be ticked. A new key starts with Read and Run operations, which is enough to send requests and read what came of them.
| Permission | Scope | What it lets the key do |
|---|---|---|
| Read | read | Read operations, executions, the ledger and the model catalogue |
| Run operations | gateway:write | Run a flow |
| Read settings | management:read | Read flows, connections, pools and customers |
| Change settings | management:write | Change them and the budgets |
| Customers: read | customers:read | Read the customers, their accounts and statements, and the credit prices |
| Customers: top-up, charge, block | customers:write | Create, top up, charge, adjust, block and delete customers |
Authentication says what each scope includes. The scope flows:write has no tick of its own on this page, because Change settings includes it. Give a key only what its service needs.
4. Create the key and copy it
Press Create key. The key starts with sl_live_ and is shown once. Copy it and put it where the service reads its secrets.
Slen keeps only a hash of the key. After the window is closed, the key cannot be shown again. If it is lost, rotate it.
Check the key
Send a request with the new key. This one needs the Read permission.
curl https://api.slen.ai/api/v1/models \
-H "Authorization: Bearer $SLEN_API_KEY"{
"data": [
{
"model_code": "gpt-4o-mini",
"provider": "openai",
"model_price_id": "1108",
"input_price_per_million": "0.15000000",
"output_price_per_million": "0.60000000",
"cached_input_price_per_million": "0.07500000",
"max_output_tokens": 16384,
"currency": "USD",
"effective_from": "2026-01-01T00:00:00+00:00",
"effective_to": null
}
]
}An answer 401 with the code invalid_api_key means the key was copied wrong. An answer 403 with the code insufficient_scope means the key works and lacks the permission.
Rotate a key
Rotation replaces the secret of a key and keeps the key itself, with its name and its permissions. Open the menu in the row of the key, choose Rotate and confirm. The new secret is shown once, like the secret of a new key.
The old secret stops working at once, and every service that still sends it gets 401. Have the new secret ready to deploy before you rotate.
Revoke a key
Open the menu in the row of the key, choose Revoke and confirm. The key stops working at once and cannot be restored. It moves to the list of revoked keys at the bottom of the page, with the time it was revoked.
A key does not expire. It works until it is revoked.
Change what a key may do
The permissions of a key are chosen when it is issued and are not edited afterwards. To give a service more, or less, follow three steps.
Issue a new key with the permissions the service needs.
Switch the service to the new key.
Revoke the old key.
The key of an application
An application that runs flows for its customers and keeps their credits needs a key with two permissions: Run operations and Customers: top-up, charge, block. Such a key runs flows and adds, tops up, charges, adjusts, blocks and deletes the customers of its project. It reads the customers, their statements and the credit prices as well, because Customers: top-up, charge, block includes Customers: read. It changes no flow, budget, credit price or key: those need Change settings.
A key with Change settings keeps the customers too, because that permission includes both permissions of the customers. Customers and credits lists what each operation of the customers needs.
Keys and projects
A key belongs to the project it was issued in and acts in that project only. A service that works with two projects needs a key of each. Authentication says what a key reaches.