---
title: AI keys
description: Use your own OpenAI and Anthropic keys, create gateway keys for your code, choose a project per request, and connect a service to the AI Gateway on the canvas.
section: AI
order: 2
---

The AI Gateway uses two kinds of key. Provider keys are your own OpenAI and Anthropic keys, which the gateway uses to call the provider, and gateway keys are what your code sends to the gateway. Both live under **AI Gateway**, then **Keys**.

## Add your own OpenAI or Anthropic key

Under **Provider keys**, choose **Add key** next to OpenAI or Anthropic, paste the key and choose **Save key**. OpenAI keys start with `sk-` and Anthropic keys with `sk-ant-`, and because an Anthropic key also starts with `sk-`, Dekka refuses one saved as an OpenAI key. A key with the wrong prefix answers 422 `invalid_provider_key`.

Only admins and owners can add or remove provider keys, and only while signed in to the dashboard, so an API key can't. Dekka encrypts the key and shows only its last four characters again. Each provider has one key at a time, so saving a new one replaces the old one straight away, and **Remove** stops Dekka using it.

## What if I don't add a key?

Requests to a provider without a key of your own use Dekka's key for that provider where there is one, and otherwise answer 503 `provider_unavailable`. With your own key, the provider bills your account for the tokens. Either way, every answered request counts its tokens against your plan's AI token allowance.

## Create a gateway key

Under **Gateway keys**, choose **Create gateway key**, give it a name such as `local-development`, choose the **Project** its requests belong to, or **Every project**, and choose **Create key**. Dekka shows the key, which starts with `dk_`, once and stores only a hash, so copy it before you close the dialog.

A gateway key has the single scope `ai`, which reaches the gateway under `/v1/ai` and answers 404 on every other route, so it can't manage your organisation. Only admins and owners can create one, from the dashboard. It doesn't expire, so revoke it with the bin icon next to it when you stop using it.

The gateway answers 401 `invalid_api_key` for a key that is wrong, expired or revoked, and 403 `ai_scope_required` for an API key without the `ai` scope.

## Choose a project for each request

A key tied to a project logs every request against that project and follows its [routing rules](/docs/ai-routing). A key for every project logs its requests without a project, with no routing rules or spend cap, unless the request names a project in the `X-Dekka-Project` header. The project ID is in the dashboard's address after `/projects/`.

```ts
const client = new OpenAI({
  baseURL: "https://api.dekka.cloud/v1/ai",
  apiKey: process.env.DEKKA_AI_KEY,
  defaultHeaders: { "X-Dekka-Project": process.env.DEKKA_PROJECT_ID },
});
```

The project must belong to your organisation, and a key tied to one project can only name that project. Anything else answers 404 `project_not_found`.

## Connect a service on the canvas

A service on Dekka can get its own gateway key without you creating one. On the project's canvas, choose **Add**, then **AI Gateway**, and choose **Add AI Gateway**. Then drag from the right edge of your service to the AI Gateway node.

Dekka creates a gateway key for that connection, tied to the project, sets `DEKKA_AI_BASE_URL` and `DEKKA_AI_KEY` on the service and restarts it. The line turns solid once the restart succeeds, and a stopped service picks the variables up when it next starts.

```ts title="ai.ts"
import OpenAI from "openai";

export const ai = new OpenAI({
  baseURL: process.env.DEKKA_AI_BASE_URL,
  apiKey: process.env.DEKKA_AI_KEY,
});
```

These keys don't appear under **Gateway keys**. Removing the connection, the service or the environment revokes the key.