Guides

Key permissions

Give each app or agent a key that can do only what it needs: some functions, some APIs, a spending cap and an expiry. The gateway checks every request before anything is billed.

What a key can do

Set permissions when you create a key in Console → API Keys, or later in its settings. With nothing selected a key has full access, which is how every existing key works.

Functions

call

Call marketplace APIs (/gw, /v1/run, MCP tools) and your hosted gateway routes.

ai

Use the AI gateway (/ai/v1).

ws

Open WebSocket streams.

runs:read

Read run results and history (/v1/runs).

wallet:read

Read the balance and transactions (/v1/wallet).

api:<slug>

Only these marketplace APIs. Pick them by name in the console; add as many as you need.

The two kinds work independently: choosing only APIs leaves every function allowed, and choosing only functions leaves every API allowed.
/v1/auth/whoami works with any valid key and shows its scopes, so tools can check what a key may do.
Discovery (/v1/discover, /v1/inspect) needs no key and is never restricted.

When a call isn't allowed

The gateway answers 403 and names the missing scope or API. Nothing is charged and the call isn't forwarded.

403

HTTP/1.1 403 Forbidden
{
  "error": "this API key can't call AI models (missing scope ai)",
  "statusCode": 403
}

Check a key

bash

curl -s https://gw.pikeway.ai/v1/auth/whoami -H "Authorization: Bearer $PIKEWAY_API_KEY"

{
  "email": "[email protected]",
  "key": {
    "name": "nightly-agent",
    "scopes": ["call", "api:birdeye", "api:dexscreener"],
    "fullAccess": false,
    "expiresAt": "2026-11-26T00:00:00Z",
    "budget": { "limit": 5, "used": 0.42, "currency": "USD" }
  }
}

With the CLI: pikeway whoami.

Keys for agents that run unattended

Permissions: call only, and only the APIs the task uses.
A spending cap (USD, total) so a loop can't drain your balance.
An expiry (7, 30 or 90 days) so a forgotten key stops working on its own.
One key per agent, so its usage and spending show up on their own.

Revoked, rotated and expired keys stay listed under Revoked for 90 days, with the reason and what they spent.