Skip to main content
A service key gives a pipeline, AI agent, or integration its own credentials for Arize AX, with the roles you choose in each organization and space it works in. Because the key belongs to a bot user, it keeps working when the person who created it leaves a space or is removed from the account, so shared automation does not break when team membership changes. Scripts and tools that run as you use an API key instead.

​
Create a service key

  1. Go to Settings → Account Settings → Service Keys and click New Service Key.
  2. Enter a Key Name and choose an Account Role.
  3. Set an expiration date if you want. The default is no expiration. Accounts with a key lifetime limit cannot set a date past that limit.
  4. Click Add organizations and select them.
  5. For each organization, choose an Organization Role and click Add space. The default organization role is Read Only.
  6. For each space, choose a role. The default is Member.
  7. Click Create Service Key and copy the key. The key is shown only once.
Create Service Key dialog with Key Name, Account Role set to Account Member, Expiration date set to Never, and an Add organizations button

The Create Service Key dialog, with the key name, account role, expiration date, and organizations.

Creating a service key requires developer access and the SERVICE_KEY_CREATE permission in every space the key covers.

​
Refresh a service key

Refreshing a service key issues a new key with the same name and type and revokes the old one. To avoid a gap while you update your systems, pass a grace period in the API and the old key stays valid for that period. Account admins can refresh any service key, and space admins can refresh a key if they are admins of every space it covers. Other members can refresh only keys they created, and they need SERVICE_KEY_CREATE. A refreshed key keeps the original expiration date unless you supply a new one, which cannot be later than the original.

​
Revoke a service key

Revoking a service key disables it in every organization and space it covers. Account admins can revoke any service key, and admins of every space a key covers can revoke it too. Other members can revoke only keys they created, and they need SERVICE_KEY_REVOKE in every space the key covers.
Nobody can create or refresh service keys while the developer access lock under Account Settings → Security is on. Existing service keys keep working.