Manage API keys

An API key authenticates a person or a service account to W&B. This page describes the kinds of API keys W&B issues, where to find and manage them, and the organization settings that restrict how members create and use them. It’s intended for organization admins and team admins who govern credentials, and for members who manage their own keys. To store keys safely once you have them, see Store and handle API keys securely.

Types of API keys

W&B issues API keys to both people and service accounts.

Key type	Belongs to	Scope
Personal API key	A user	Every organization the user belongs to
Organization-scoped API key	A user, within one organization	Only that organization’s resources
Team service account key	A service account	One team
Organization service account key	A service account	All teams in the organization

An organization-scoped API key and an organization-scoped service account are different things. An organization-scoped API key belongs to a person and authenticates that person, limited to a single organization. An organization-scoped service account is a non-human identity used for automation, and it has its own API keys. A user can hold an organization-scoped API key without any service account being involved.

Organization-scoped API keys limit the damage a leaked key can do. A personal API key works in every organization its owner belongs to, so a key exposed in a public repository can reach resources in an unrelated organization. An organization-scoped key only works in the organization it was created for. Organization-scoped API keys are available in Multi-tenant Cloud for Enterprise organizations, and W&B enables them per organization. If you don’t see the options described in the following sections, contact your W&B account team.

Find and manage API keys

Organization admins, team admins, and members manage keys from the API Keys tab.

Multi-tenant Cloud
Dedicated Cloud and Self-Managed

Click your profile icon in the upper right, then select your organization.
Navigate to https://wandb.ai/account-settings/[ORGANIZATION]/api-keys. Replace [ORGANIZATION] with your organization name. The API Keys tab lists the keys you have permission to see.

Navigate to the Organization Dashboard:
- Dedicated Cloud: https://[ORG-NAME].io/org/dashboard/. Replace [ORG-NAME] with your organization name.
- Self-Managed: https://[YOUR-W&B-SERVER-IP]/org/dashboard. Replace [YOUR-W&B-SERVER-IP] with your deployment’s IP address.
Click the API Keys tab. The tab lists the keys you have permission to see.

To find only your own personal API keys, click your profile icon, then click User Settings and scroll to API Keys. See User settings.

In Multi-tenant Cloud, users whose organization role is billing admin can’t see the API Keys tab. In Dedicated Cloud and Self-Managed, the tab isn’t restricted by billing role.

Key visibility by role

The keys listed in the API Keys tab depend on your role:

Role	Can see
Member	Their own organization-scoped keys
Team admin	Their own organization-scoped keys, and keys for service accounts in teams they administer.
Organization admin	All organization-scoped keys in the organization, including organization service account keys.
Billing admin	In Multi-tenant Cloud, nothing. The API Keys tab is hidden for this role. In Dedicated Cloud and Self-Managed, the same keys as a member.

Read the API keys table

The table lists each key with the following columns:

Key name: The descriptive name given to the key when it was created.
Key ID: The first part of the key, used for identification.
Owner: The user or service account that owns the key.
Last used: When the key most recently authenticated a request.
Created on: When the key was created.

For security, the table shows only the key ID. W&B displays the full secret key once, when you create it. If you no longer have the full secret for a key, rotate the key.

To narrow the list, type in the search field to match a key name, key ID, or owner, or click Filters to filter by attributes such as key type.

Create an API key

Go to the API Keys tab.
Click New key.
Give the key a descriptive name.
Click Create.
Copy the key immediately and store it securely.

W&B shows the full API key only once, when you create it. After you close the dialog, you cannot view the full API key again. Your settings display only the key ID (the first part of the key). If you lose the full API key, you must create a new one.

In Multi-tenant Cloud, keys you create from this tab are scoped to the organization you’re viewing. Create a separate key for each organization you work in.

Rename an API key

Rename a key to record what uses it, which makes an unfamiliar key easier to trace later. Renaming doesn’t change the key’s secret and doesn’t interrupt anything that uses it.

Find the key in the table.
Click the actions menu at the end of the key’s row, then click Edit.
Enter a new name, then save.

Delete API keys

Delete a key when you no longer need it, or immediately if it may have been exposed. To delete a single key, find it in the table, click the actions menu at the end of its row, then click Delete and confirm. To delete several keys at once:

Select the checkbox next to each key you want to delete.
Click Delete. The button shows the number of keys you selected.
Confirm the deletion.

Deleting a key immediately revokes access for any script or service that uses it. Update your systems to use a replacement key before you delete the old one.

Rotate an API key

Rotate a key on a schedule that matches your security policy, and immediately if a key may have been exposed. Rotate a key rather than delete it when the workloads that use it must keep running. W&B has no single rotate action. Because a key’s full secret is shown only at creation, you rotate a key by replacing it:

Create a new API key. Give it a name that distinguishes it from the key you’re replacing.
Update every script, job, and stored secret that uses the old key. For storage options, see Store and handle API keys securely.
Confirm that your workloads authenticate with the new key.
Delete the old key.

Until you complete the last step, both keys work. This overlap is what lets you rotate without downtime, so keep it short.

If a key was exposed publicly, delete it immediately rather than waiting to update your systems. An exposed key stays valid until you delete it.

Restrict how members use API keys

Organization admins can restrict key creation and use. The available restrictions differ by deployment type, and each is set through the updateOrganizationPrivacySettings GraphQL mutation rather than through the W&B App.

Require organization-scoped API keys

Available in Multi-tenant Cloud for Enterprise organizations. When enabled, only organization-scoped API keys can access the organization’s resources. Personal API keys that a member uses across several organizations no longer work against this organization, which prevents a key leaked from elsewhere from reaching your data. Replace [ORGANIZATION-ID] with the ID of your organization.

mutation RequireOrgScopedAPIKeys {
  updateOrganizationPrivacySettings(
    input: {organizationId: "[ORGANIZATION-ID]", requireOrgScopedAPIKeys: true}
  ) {
    success
  }
}

This setting requires that organization-scoped API keys are already enabled for your organization. Contact your W&B account team to confirm.

Disable API key creation

Available in Dedicated Cloud and Self-Managed v0.84.0 and above. When enabled, members of the organization can’t create new API keys. Existing keys keep working, so turning this on doesn’t interrupt running jobs. Use it when your organization issues keys through a controlled process and you want to prevent members from creating their own. Replace [ORGANIZATION-ID] with the ID of your organization.

mutation DisableAPIKeyCreation {
  updateOrganizationPrivacySettings(
    input: {organizationId: "[ORGANIZATION-ID]", disableApiKeyCreation: true}
  ) {
    success
  }
}

A member who tries to create a key after you enable this setting receives the following error:

API key creation has been disabled by your organization administrator

To restrict service account creation as well, see GORILLA_DISABLE_TEAM_SERVICE_ACCOUNT_CREATION, which prevents the creation of new team-scoped service accounts in Dedicated Cloud and Self-Managed v0.83.0 and above.

Availability

API key capabilities differ by deployment type and, in Multi-tenant Cloud, by subscription. The following table summarizes where each capability is available.

Capability	Multi-tenant Cloud	Dedicated Cloud	Self-Managed
Search and filter the API keys table	Yes	v0.84.0+	v0.84.0+
Create a key from the API Keys tab	Enterprise organizations	v0.84.0+	v0.84.0+
Delete several keys at once	Enterprise organizations	v0.84.0+	v0.84.0+
Organization-scoped API keys	Enterprise organizations	Not available	Not available
Require organization-scoped API keys	Enterprise organizations	Not available	Not available
Disable API key creation	Not available	v0.84.0+	v0.84.0+

Store and handle API keys securely

API keys provide access to your W&B account and should be protected like passwords. The following sections describe recommended storage methods, practices to avoid, how to pass keys to your code, and SDK version requirements for newer keys.

Recommended storage methods

Use one of the following methods to store your API key securely.

Secrets manager: Use a dedicated secrets management system such as AWS Secrets Manager, HashiCorp Vault, Azure Key Vault, or Google Secret Manager.
Password manager: Use a reputable password manager application.
OS-level keychains: Store keys in macOS Keychain, Windows Credential Manager, or Linux secret service. Not suggested for production.

What to avoid

Avoid the following practices, which can expose your API key:

Never commit API keys to version control systems such as Git.
Don’t store API keys in plain text configuration files.
Don’t pass API keys on the command line, because they’re visible in the output of OS commands like ps.
Avoid sharing API keys through email, chat, or other unencrypted channels.
Don’t hard-code API keys in your source code.

If an API key is exposed, delete the API key from your W&B account immediately and contact support or your AISE.

Environment variables

When you use API keys in your code, pass them through environment variables:

export WANDB_API_KEY="[YOUR-API-KEY]"

This approach keeps keys out of your source code and makes it easier to rotate them when needed.

Avoid setting the environment variable in line with the command, because it’s visible in the output of OS commands like ps:

# Avoid this pattern, which can expose the API key in process managers
export WANDB_API_KEY="[YOUR-API-KEY]" ./my-script.sh

SDK version compatibility

If you use a newer API key, confirm that your SDK version supports it. Newer API keys are longer than legacy keys. When you authenticate with older versions of the wandb or weave SDKs, you may encounter an API key length error. Solution: Update to a newer SDK version:

wandb SDK v0.22.3+
pip install --upgrade wandb==0.22.3
weave SDK v0.52.17+
pip install --upgrade weave==0.52.17

If you can’t upgrade the SDK immediately, set the API key using the WANDB_API_KEY environment variable as a workaround.

Weights & Biases

Powered by CoreWeave

Platform Details

Resources

Types of API keys

Find and manage API keys

Key visibility by role

Read the API keys table

Create an API key

Rename an API key

Delete API keys

Rotate an API key

Restrict how members use API keys

Require organization-scoped API keys

Disable API key creation

Availability

Store and handle API keys securely

Recommended storage methods

What to avoid

Environment variables

SDK version compatibility

​Types of API keys

​Find and manage API keys

​Key visibility by role

​Read the API keys table

​Create an API key

​Rename an API key

​Delete API keys

​Rotate an API key

​Restrict how members use API keys

​Require organization-scoped API keys

​Disable API key creation

​Availability

​Store and handle API keys securely

​Recommended storage methods

​What to avoid

​Environment variables

​SDK version compatibility

Types of API keys

Find and manage API keys

Key visibility by role

Read the API keys table

Create an API key

Rename an API key

Delete API keys

Rotate an API key

Restrict how members use API keys

Require organization-scoped API keys

Disable API key creation

Availability

Store and handle API keys securely

Recommended storage methods

What to avoid

Environment variables

SDK version compatibility