SaibleDocs
Access

Keys and their holders

Five keys, each with one purpose.

YOUR NETWORKApplicationSaible gateway144 signs every record inside the gatewayProvidersyour keys2Saiblecontrol planeEU or US355 signs the policy revision that every gatewaypulls and checks before using it
Five keys, each with one purpose
  • 1Application key
    sk-saible-…an application → the gatewayThe application's owner or an organisation admin rotates or revokes it.After rotation the old key keeps working for an overlap period (7 days by default). An optional maximum age can be set.
  • 2Provider keys
    yoursthe gateway → your providersYou hold them, and they stay in your network.Saible never receives them.
  • 3Gateway credential
    sk-saible-gw-…the gateway → SaibleAn organisation admin issues it on Gateways. It is shown once.It expires after 365 days. Rotate or revoke it on the same page.
  • 4Instance key
    Ed25519signs each recordCreated inside each gateway instance.It never leaves the gateway process. Its public key is sent to Saible.
  • 5Policy signing key
    Ed25519signs the policy revisionSaible's own signing key.Each gateway pins Saible's root key at installation and accepts only signing keys announced by that root key, so the signing key can rotate without changes to your installation.
Steps
  1. 1On AI catalogue, register an application. Its application key is shown once.
  2. 2Configure the application to send that key as its API key. The gateway reads x-api-key or Authorization: Bearer.
  3. 3Rotate the key on the application's page. The old key keeps working during the overlap period.
  4. 4On Gateways, issue each gateway's credential and keep it in your secrets store.
For your agents

This topic is also documented as Agent Skills that your agents can load: registry, gateways, settings. Request them from Saible.

Next · Control Plane · CoverageControl coverage, in seven areas →