Skip to main content

Overview

Let developers get gateway access and manage their own keys, without an admin minting a key for every person.

If you are a...Read
Platform admin turning self-service on for an appAdmin Guide
Developer who was granted access to an appDeveloper Guide

How It Works​

Admin Grants Access
App: Support Bot
Viewer: engineering smart group
Mode: Named user keys
User Signs In
alice@acme.com
Self-Service portal
Sees: Support Bot ✓
User Gets a Key
Creates "Alice local dev"
sk-quilr-•••:ss1.•••
Calls the gateway ✓
QuilrAI
  1. Admin grants access in the app's Self-Service settings: who can view the app, request or make changes, see keys and see all logs.
  2. User signs in to the Self-Service portal and sees only the apps they were granted.
  3. User gets a key: the shared app key, or a personal key they create, depending on the app's credential mode.

Credential Modes​

The credential mode decides which kind of key allowed users receive. It does not decide who has access.

ModeShown in reports asWhat the user getsRuntime behavior
Shared Parent Key (default)Main app keyThe existing app key (sk-quilr-…)The shared key works as-is.
Named User API KeysPersonal keysA personal key each user createsOnly a valid named key is accepted. A bare parent key, a JWT, or an X-User-Email header alone are rejected.

A named key is the app key with a self-service payload appended. Use the whole string anywhere you would use an sk-quilr-… key:

sk-quilr-<app-key>:ss1.<encoded-identity>.<random>

The payload identifies the user and key, and the random suffix lets one person hold several keys for the same app. Every request is attributed to the user behind the key, the same per-user view you get with Identity Aware.

Capabilities​

Five capabilities are granted independently: Viewer access, Settings request access, Direct settings update, API key visibility and All-logs visibility. Self-service is denied by default. See Grant capabilities for what each one does and how to scope it.

Local MCP tools​

The Self Service portal also has Your local tools, where people connect their AI app to permitted local MCP tools. See Connect your AI app. When no tools are permitted, administrators get a Manage MCP access shortcut to the MCP Gateway settings; see Manage MCP access.

Limitations​

  • Revoking access does not revoke issued keys. Removing a user hides the app and stops them creating new keys, but keys they already created or copied keep working. Revoke named keys individually, or rotate the shared app key.
  • Named keys are soft-revoked: a revoked key stops working, but its record is kept for audit history.
  • Audit Log - approve change requests, review config history, and roll back changes.
  • Identity Aware - per-user identity and domain controls.

On this page