Skip to main content
Arize AX supports two types of API keys:
  • User keys are tied to your user account and inherit all the permissions you have. If you have admin access to Space A and read-only access to Space B, the key reflects these permissions. If you are removed from the account, the key is disabled.
  • Service keys are designed for automated services and applications that need to persist beyond individual users. Service keys are tied to bot users rather than human users, ensuring they continue to work even if the original creator leaves the organization.

​
Create a User Key

  1. Go to Settings → API Keys.
  2. Click + New API Key.
  3. Ensure User Key is selected as the Key Type.
  4. Enter a Key Name.
  5. Click Create Key.
  6. Copy and save the key immediately. For security, the full key is shown only once during creation.
Treat your key like a password — store it somewhere secure and rotate it regularly.

​
Create a Service Key

A single service key can be bound to multiple organizations and spaces, each with its own role. The key services a pipeline, agent, or integration that spans several teams. Least privilege still applies: the roles you grant must be at or below your own access level at each scope.
  1. Go to Settings → API Keys and select the Service Keys tab.
  2. Click + New Service Key.
  3. Enter a Key Name to identify its purpose (e.g., “Production Data Pipeline” or “QA Environment”).
  4. Optionally choose an Account Role (defaults to Member) and an expiration date (defaults to never expiring).
  5. Under Organizations & Spaces, click Add organizations and select one or more organizations for the key.
  6. For each organization, optionally set an Organization Role (defaults to Read-Only), then click Add space and select the spaces this key should access. Each organization must include at least one space.
  7. Choose a role for each space: Admin, Member, Read-Only Member, or a custom role if your account has them (defaults to Member).
  8. Click Create Key.
  9. Copy and save the key immediately. For security, the full key is shown only once during creation.
Service keys can also be created programmatically with the same organization/space bindings via the REST API, the Python and Go SDKs, or the ax CLI (ax api-keys create-service-key --assignments ...). Revoking a service key disables it across all organizations and spaces it is bound to.

​
Who Can Create Service Keys

Service keys inherit the permission restrictions of their creator — you cannot grant a service key more permissions than you currently have. This check applies at every scope: for each organization and space you bind the key to, the role you assign must be at or below your own role there.

​
Key Differences from User Keys

The main differences between service keys to user keys are:
  • Persistence: Service keys remain active even if the creator leaves the organization
  • Restricted Permissions: Can be configured with limited permissions for specific use cases
  • Bot User Association: Each service key is tied to a bot user account rather than a human user
  • Organizational Continuity: Designed for long-running services and automation

​
Where You Can Use Keys

Both user keys and service keys authenticate every Arize client and workflow:
  • pandas logger
  • Dataset uploads & validations
  • Experiments
  • Exports
  • GraphQL & REST endpoints
  • Anything supported by the Arize SDK v7.40.1+