Skip to main content
An API key authenticates a person or a service account to W&B. This page describes the kinds of API keys W&B issues, where to find and manage them, and the organization settings that restrict how members create and use them. It’s intended for organization admins and team admins who govern credentials, and for members who manage their own keys. To store keys safely once you have them, see Store and handle API keys securely.

​
Types of API keys

W&B issues API keys to both people and service accounts.

​
Find and manage API keys

Organization admins, team admins, and members manage keys from the API Keys tab.
  1. Click your profile icon in the upper right, then select your organization.
  2. Navigate to https://wandb.ai/account-settings/[ORGANIZATION]/api-keys. Replace [ORGANIZATION] with your organization name. The API Keys tab lists the keys you have permission to see.
To find only your own personal API keys, click your profile icon, then click User Settings and scroll to API Keys. See User settings.
In Multi-tenant Cloud, users whose organization role is billing admin can’t see the API Keys tab. In Dedicated Cloud and Self-Managed, the tab isn’t restricted by billing role.

​
Key visibility by role

The keys listed in the API Keys tab depend on your role:

​
Read the API keys table

The table lists each key with the following columns:
  • Key name: The descriptive name given to the key when it was created.
  • Key ID: The first part of the key, used for identification.
  • Owner: The user or service account that owns the key.
  • Last used: When the key most recently authenticated a request.
  • Created on: When the key was created.
For security, the table shows only the key ID. W&B displays the full secret key once, when you create it. If you no longer have the full secret for a key, rotate the key.
To narrow the list, type in the search field to match a key name, key ID, or owner, or click Filters to filter by attributes such as key type.

​
Create an API key

  1. Go to the API Keys tab.
  2. Click New key.
  3. Give the key a descriptive name.
  4. Click Create.
  5. Copy the key immediately and store it securely.
W&B shows the full API key only once, when you create it. After you close the dialog, you cannot view the full API key again. Your settings display only the key ID (the first part of the key). If you lose the full API key, you must create a new one.
In Multi-tenant Cloud, keys you create from this tab belong to the organization you’re viewing. Create a separate key for each organization you work in.

​
Rename an API key

Rename a key to record what uses it, which makes an unfamiliar key easier to trace later. Renaming doesn’t change the key’s secret and doesn’t interrupt anything that uses it.
  1. Find the key in the table.
  2. Click the actions menu at the end of the key’s row, then click Edit.
  3. Enter a new name, then save.

​
Delete API keys

Delete a key when you no longer need it, or immediately if it may have been exposed. To delete a single key, find it in the table, click the actions menu at the end of its row, then click Delete and confirm. To delete several keys at once:
  1. Select the checkbox next to each key you want to delete.
  2. Click Delete. The button shows the number of keys you selected.
  3. Confirm the deletion.
Deleting a key immediately revokes access for any script or service that uses it. Update your systems to use a replacement key before you delete the old one.

​
Rotate an API key

Rotate a key on a schedule that matches your security policy, and immediately if a key may have been exposed. Rotate a key rather than delete it when the workloads that use it must keep running. W&B has no single rotate action. Because a key’s full secret is shown only at creation, you rotate a key by replacing it:
  1. Create a new API key. Give it a name that distinguishes it from the key you’re replacing.
  2. Update every script, job, and stored secret that uses the old key. For storage options, see Store and handle API keys securely.
  3. Confirm that your workloads authenticate with the new key.
  4. Delete the old key.
Until you complete the last step, both keys work. This overlap is what lets you rotate without downtime, so keep it short.
If a key was exposed publicly, delete it immediately rather than waiting to update your systems. An exposed key stays valid until you delete it.

​
Restrict how members use API keys

Organization admins can restrict key creation and use from the organization settings in the W&B App. These restrictions limit which keys can reach your organization’s resources and who can create new ones. The following sections describe the available restrictions, which differ by deployment type.

​
Enforce organization-scoped API keys

Available in Multi-tenant Cloud for Enterprise organizations. W&B enables this setting per organization. If you don’t see it, contact your W&B account team. When enforced, only organization API keys and keys that belong to service accounts in the organization can reach the organization’s resources. A personal API key that a member uses across several organizations no longer works against this organization, which prevents a key leaked from elsewhere from reaching your data.
Personal API keys lose read and write access to the organization as soon as you enforce this setting, and any integration that uses a personal key stops working. Notify your users before you enforce it.
To enforce organization-scoped API keys, complete the following steps:
  1. Sign in as an organization admin.
  2. Open your organization settings, then select Authentication in the left navigation.
  3. Next to Enforce organization-scoped API keys, click Enforce.
  4. Type your organization name to confirm, then click Enforce Organization-Scoped API Keys.
W&B then shows an Enforced label next to the setting. To stop enforcing it, return to Authentication and click Disable.

​
Disable API key creation

Available in Dedicated Cloud and Self-Managed v0.84.0 and above. When enabled, users and team service accounts can’t create new API keys. Organization service accounts can still create keys, and existing keys keep working, so turning this on doesn’t interrupt running jobs. Use it when your organization issues keys through a controlled process and you want to prevent members from creating their own. To disable API key creation, complete the following steps:
  1. Sign in as an organization admin.
  2. Open your organization dashboard, then select Privacy in the left navigation.
  3. In the Access Control section, turn on Disable API key creation.
W&B saves the change immediately. For the other settings on this tab, see Configure privacy settings. While the setting is on, the API Keys tab disables the New key button and shows the following message:
To restrict service account creation as well, see GORILLA_DISABLE_TEAM_SERVICE_ACCOUNT_CREATION, which prevents the creation of new team-scoped service accounts in Dedicated Cloud and Self-Managed v0.83.0 and above.

​
Availability

API key capabilities differ by deployment type and, in Multi-tenant Cloud, by subscription. The following table summarizes where each capability is available.

​
Store and handle API keys securely

API keys provide access to your W&B account and should be protected like passwords. The following sections describe recommended storage methods, practices to avoid, how to pass keys to your code, and SDK version requirements for newer keys. Use one of the following methods to store your API key securely.

​
What to avoid

Avoid the following practices, which can expose your API key:
  • Never commit API keys to version control systems such as Git.
  • Don’t store API keys in plain text configuration files.
  • Don’t pass API keys on the command line, because they’re visible in the output of OS commands like ps.
  • Avoid sharing API keys through email, chat, or other unencrypted channels.
  • Don’t hard-code API keys in your source code.
If an API key is exposed, delete the API key from your W&B account immediately and contact support or your AISE.

​
Environment variables

When you use API keys in your code, pass them through environment variables:
This approach keeps keys out of your source code and makes it easier to rotate them when needed.
Avoid setting the environment variable in line with the command, because it’s visible in the output of OS commands like ps:

​
SDK version compatibility

If you use a newer API key, confirm that your SDK version supports it. Newer API keys are longer than legacy keys. When you authenticate with older versions of the wandb or weave SDKs, you may encounter an API key length error. Solution: Update to a newer SDK version:
  • wandb SDK v0.22.3+
  • weave SDK v0.52.17+
If you can’t upgrade the SDK immediately, set the API key using the WANDB_API_KEY environment variable as a workaround.