Organizations and workspaces
API keys and widget keys per workspace
Each workspace has its own secret API key, made with the workspace and shared by its environments; widget keys belong to agents, so they stay with the workspace that owns the agent.
Reference1 min readUpdated 1 November 2026
Keys belong to workspaces, not to people or organizations, so each workspace's traffic is its own.
| Key | Belongs to | What it reaches |
|---|---|---|
Secret key (sk-so-) | The workspace. Each workspace gets its own when it's made; the API keys page shows the open workspace's | Every agent and workflow in that workspace, in any of its environments (name one with X-Environment). Nothing in other workspaces |
Widget key (pk-so-) | One agent, or one published workflow, so the workspace that owns it | That agent only, from its allowed websites |
| LLM keys | The workspace: saved under LLM keys, picked on its agents | Model calls for that workspace's agents |
- Switching workspaces changes the key the API keys page shows and the code samples use. Your servers keep working: a key doesn't change when people change roles or leave.
- Environments don't have keys of their own. The same secret key reaches Development, Staging and Production; the environment is chosen per request. See Choose which environment answers.
- Archiving a workspace pauses its keys: requests to its agents get
402 WORKSPACE_ARCHIVEDuntil it's restored. Deleting its organization deletes them. See Archive and restore a workspace. - Rotate a widget key on the agent's Deploy tab. The secret key still can't be rotated from the app: email support if it leaks. See API keys.
Did my key change when organizations arrived?
No. Your Default workspace kept the key your account had.
A teammate needs to call the API
Give them access to the workspace, or put the workspace's key in your shared secret store. Keys aren't per person.
Related
Still stuck?
Email us with what you tried and any request id. A person replies.