Keys and projects
This page is for anyone deciding which key to create. Mubit uses three kinds of key, and each does one job.
| Key | Prefix | Sent by | What it does |
|---|---|---|---|
| Mubit inference key | mbt_ (older keys: mw_) | Your app, in place of the provider key | Sends model calls through Mubit, and calls runtime calibration |
| Management key | mwm_ | Scripts, CI and developer tools | Reads and changes your organization's records through the management API |
| Provider key | The provider's own | Mubit, to the provider | Pays for the calls Mubit passes on to your provider |
Your provider's key never goes in your app. You add it in the console, and Mubit sends it with the calls it passes on.
Mubit inference keys
Your app sends an inference key in place of a provider key. Create one under Mubit keys, or in the first-time setup. A key works for one project only, and the console shows the whole key once, when you create it.
An inference key has one of two permissions:
- Inference: calls this project. For apps that send calls.
- Read only: reads its records. Reads this project's records. A call sent with it is refused with
403 key_permission.
New keys start with mbt_. Keys issued earlier may start with mw_. Mubit accepts both on model calls. Inference keys work on the model-call paths (/openai, /anthropic, /gemini) and on runtime calibration. They don't work on the management API, which answers 403.
Mubit keys shows how to create, rotate and revoke an inference key.
Management keys
A management key calls the management API (/api/v1) and the tools built on it, such as the command line tool and the MCP server. It looks like mwm_<instance>_<key id>_<secret>. It is not a way to send model calls: a management key on the model-call paths answers 403.
An admin creates management keys in the console, under Management keys in the workspace. The console shows the secret once. Each key has a role, and can be limited to one project:
| Role | Can do |
|---|---|
read | Every read operation except the list of management keys. |
member | Everything read can, and the data writes: rating a call, reviewing an example, starting an import and cancelling one. |
admin | Everything member can, and management keys, inference and provider keys, projects, settings and fine-tuning controls. |
A key's role never exceeds the role of whoever created it. Revoking a key ends it within a minute, and ends the keys that were created with it. Rotating a key gives it a new secret and stops the old one within a minute.
The API reference lists the calls.
Provider keys
A provider key is the key your provider issued, such as an OpenAI, Anthropic or Gemini key. Add it under Provider keys in the console, or in the first-time setup. Mubit refuses a Mubit key pasted there, and refuses sign-in tokens such as a Claude or ChatGPT subscription login. See Provider keys.
Projects
A project holds your calls, tasks, adapters and keys. An inference key belongs to one project. A management key belongs to the organization, or to one project when you scope it. See Projects and Members and roles.
Treat every key as a secret. Keep it in an environment variable or a secret store, never in code you commit, and never in a chat with a coding agent. If a key leaks, revoke it and create a new one.