infimal
infimal.md
Docs/Manage

Access & API keys

Control who can invoke your service and what an automation is allowed to do.

Start with a private endpoint

Endpoint(public=False) requires an API key to reach the service. A public endpoint changes who can invoke it; treat that as an explicit access decision.

Python
endpoint=Endpoint(public=False)

Create a key

A key has one of two roles. Full is everything the account may do, control plane and inference, and is the default. Inference is the key to ship inside a client: it reaches the OpenAI surface, the model list and your own usage, and nothing else on the control plane. Administration is neither of them — it belongs to the account, not to any key. The secret is returned at creation and is not shown again by list. Store it in a secret manager.

Terminal / reference
infimal keys create inference-client --role inference
infimal keys create ci --role full

Inspect and revoke

List returns key metadata without secrets. Revoke takes the key ID returned by list, not its display name. Revocation also invalidates sessions minted by that key.

Terminal / reference
infimal keys list --json
infimal keys revoke KEY_ID

Keep credentials out of source

  • Use infimal login --key for local setup, or INFIMAL_API_KEY in automation.
  • Do not put a key in a command argument, URL, log, or committed file.
  • Give build and observation jobs separate credentials when their privileges differ.
  • Rotate a suspected exposed key and check dependent integrations.