API keys and permissions

Manage application identity, access scope and budgets.

Create and store

Create and securely store a dedicated virtual key per application. Provider credentials authenticate upstream calls; virtual keys authenticate applications to XHub. They are separate credentials.

Permissions and ownership

Keys can belong to users, teams or projects. Roles, ownership and configuration constrain visibility and allowed models. A visible model does not imply support for all protocols.

Revoke and troubleshoot

Delete unused keys. For 401, check credentials. For 403, check permissions. For budget errors, inspect key and related entity limits.