Keys

/keys is where developers request virtual keys and operators run the lifecycle (reveal, rotate, block, revoke).

Concepts: Virtual keys.

List

Search by alias, ID, user, team or status. Stat cards show total keys, active keys, expiring soon (30 days), lifetime spend and budget remaining.

Table columns: alias/ID, status, team/org, user, models (access group), spend/budget bar, RPM/TPM, expiry, created/last active, attached policies (with inheritance source).

Row actions: view details, reveal, rotate, copy key ID, block/unblock, revoke.

Request a key

Keys → Request key opens a form:

Field	Notes
Ownership	PERSONAL or SERVICE_ACCOUNT (service accounts require a team)
Key name	Alias, min 3 characters
Team / application	Application is optional and filtered by team
Access group	Required — preview of models included
Policy	Optional; otherwise inherit org/team
Environment	DEVELOPMENT, STAGING, PRODUCTION
Purpose	Required, min 8 characters
Budget tier or custom	Monthly budget (default $50), duration 1d / 7d / 30d
Expiry	30 / 90 / 180 days or never
RPM / TPM	Default RPM 100

Submit creates a KeyRequest in PENDING. Reviewers work on Approvals.

Reveal

After approval the key is PENDING_REVEAL. Open Keys → reveal:

• Plaintext zea-… is minted once
• Copy the key and the gateway base URL
• Confirm “I've saved this key” before leaving
• Status becomes ACTIVE

Rotate, block, revoke

• Rotate (ACTIVE or BLOCKED): new secret, same settings; old secret dies immediately
• Block / unblock: team or platform admin; gateway rejects blocked keys with 403 key_blocked
• Revoke: permanent; 401 key_revoked

Who sees which keys

• Platform admin: all keys (org switcher filters)
• Everyone else: own keys + keys on reviewable teams + keys they requested