Automate with management keys

This guide will show how to use a management key to automate projects, keys, and limits from CI, within its admin-capped scope. A management key (rd_mk_…) is the non-interactive counterpart to a signed-in owner session: it authenticates the control plane at so CI and scripts can manage your account without a human in the loop. It is deliberately constrained — org-scoped, capped at admin, and unable to touch model traffic.

What a management key can and cannot do

Can	Cannot
Create/manage projects, environments, API keys	Owner-only actions: billing, org settings, org deletion
Add/rotate/delete provider (BYOK) credentials	Issue or revoke another management key
Configure rate limits, quotas, and budgets	Create a data export
Read usage and request logs; purge logs	Call the data plane — the gateway has no knowledge of `rd_mk_`

The cap is the point: even a leaked management key can never escalate to owner-level operations or make inference calls. It is verified only by the control plane.

1. Issue a key (owner-only)

Only an org owner can mint one. Create it from the dashboard or the control plane:

curl -X POST https://api.roadie.paroaria.ai/v1/orgs/$ORG_ID/management-keys \
  -H "Authorization: Bearer $ROADIE_OWNER_SESSION" \
  -H "Content-Type: application/json" \
  -d '{ "name": "ci-provisioning", "expires_at": "2027-01-01T00:00:00Z" }'

The role defaults to (and is capped at) admin. The response includes the plaintext key exactly once — store it in your CI secret manager immediately; it is never re-readable.

The plaintext appears only in the create response. If you lose it, revoke the key and issue a new one. Set an expires_at and rotate on a schedule so a forgotten key does not live forever.

2. Use it against the control plane

Send the key as a bearer token to . For example, provision a scoped secret key and a rate limit for a new service in one CI step:

export ROADIE_MGMT_KEY="rd_mk_…"   # from your CI secret store

# Create a restricted secret key for a service
curl -X POST https://api.roadie.paroaria.ai/v1/environments/$ENV_ID/keys \
  -H "Authorization: Bearer $ROADIE_MGMT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "summarizer-service",
    "type": "secret",
    "restrictions": { "allowed_models": ["openai/gpt-4o-mini"], "allowed_endpoints": ["chat"] }
  }'

# Cap that key to 60 requests/minute
curl -X PUT https://api.roadie.paroaria.ai/v1/environments/$ENV_ID/rate-limits \
  -H "Authorization: Bearer $ROADIE_MGMT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "scope": "key", "scope_ref": "'$NEW_KEY_ID'", "rpm": 60 }'

Every mutating call is recorded in the audit log with the acting key, so control-plane changes made from CI are fully attributable.

3. Rotate and revoke

List active keys with GET /v1/orgs/{orgId}/management-keys, and revoke one when a pipeline is retired or a key may be compromised:

curl -X DELETE https://api.roadie.paroaria.ai/v1/orgs/$ORG_ID/management-keys/$KEY_ID \
  -H "Authorization: Bearer $ROADIE_OWNER_SESSION"

Revocation is immediate — the control plane reads Postgres live, so revoked_at takes effect on the very next request with no propagation window. (Only an owner can revoke; a management key cannot revoke keys.)

Least-privilege checklist

One management key per pipeline, so revoking one never breaks the others.
Always set an expires_at and rotate before it lapses.
Store the plaintext only in a secret manager — never in source, logs, or an environment file committed to the repo.
Reach for a scoped secret key instead when a workload only needs the data plane; a management key is for the control plane.

Automate with a management key

A CI walkthrough end to end.

Authentication & API keys

Where management keys sit among the six credentials.

Security best practices

Least-privilege and rotation across all credentials.

Control-plane reference

Every control-plane route and schema.

Get started

Core concepts

Guides

SDKs

Automate with management keys

What a management key can and cannot do

1. Issue a key (owner-only)

2. Use it against the control plane

3. Rotate and revoke

Least-privilege checklist

Automate with a management key

Authentication & API keys

Security best practices

Control-plane reference

​What a management key can and cannot do

​1. Issue a key (owner-only)

​2. Use it against the control plane

​3. Rotate and revoke

​Least-privilege checklist

​Related

Automate with a management key

Authentication & API keys

Security best practices

Control-plane reference

What a management key can and cannot do

1. Issue a key (owner-only)

2. Use it against the control plane

3. Rotate and revoke

Least-privilege checklist

Related