Access management concepts

Access management allows you to define who can use your organization’s resources, like models or MCP servers, in AI Gateway.

Access management features define:

• Who can make requests to your AI Gateway resources.
• What they are allowed to do.
• Which limits apply to them.
• How your organization is structured.

You can apply rules to users individually, or in bulk using groups.

A user is a person who is added to the system in one of the following ways:

To stop a user from signing in while keeping their history, deactivate the user instead of deleting them.

Users imported from an org structure file are managed by that file:

• Their name and email are read-only.
• You can’t delete them. If a later import no longer lists them, they are deactivated, not deleted.

To change imported users, import an updated org chart.

You can view all users in one searchable table. Search matches on the user’s name. You can filter the table by team and status, and show or hide columns such as metadata and labels.

Open a user to see their details. The Provisioned by field shows how the user was added, for example Imported for users from an org structure import.

Teams

Teams are created automatically when you import an org chart that groups users into teams. They can’t be created manually, and you can’t manually assign a user to an existing team.

Teams can be nested under a parent team.

Import an org structure

To add users and teams in bulk, upload your org structure as a CSV file that contains the required columns:

• external_id
• email
• given_name: The user’s first name.
• family_name
• manager_external_id: Identifies who the user reports to, which the importer uses to build teams.

The first upload creates all the people and teams it lists.

Because teams change only through import, upload the file again whenever your org structure changes. Users that the new file no longer lists are deactivated, not deleted.

A group is a list of users that share the same rules. Instead of setting rules on each member, you set them once on the group. For example, you can select a group when setting up a spend limit.

Admins create groups manually. A group has a name, a description, labels, and metadata. A group can’t contain another group.

Add users to a group from the group’s detail page. You can also add or remove a user from one or more groups from the user’s details.

Groups vs teams

Both groups and teams collect users, but they are created and managed differently:

An identity provider is an external service, like Okta or Auth0, that signs the tokens users present when they sign in. Konnect trusts the providers you list and uses them to verify that those tokens are genuine.

When you add an identity provider, you give it a name and an issuer URL. You can also:

• Enable automatic user provisioning so that users are created the first time they sign in. Automatic user provisioning doesn’t give users access to the credentials stored in Token Vault. An admin must grant that access explicitly.
• Choose whether Token Vault trusts the provider.

To stop Token Vault from relying on a provider, remove its trust. To delete a provider you no longer need, delete it from the list.

Token Vault needs at least one trusted identity provider to verify callers.

To learn more, see Token Vault’s providers.

Token Vault stores credentials for third-party services so that AI Gateway can call them on behalf of a caller. When a caller acts on behalf of a user, Token Vault checks that user against a trusted identity provider before releasing credentials.

To set it up:

1. Add at least one trusted identity provider.
2. Configure how Token Vault authenticates with this provider.
3. Create credential providers. A credential provider uses either OAuth or a static API key.

When you set up an MCP server, you can choose a credential provider for outbound authentication as an alternative to pass-through. To see the credentials that Token Vault holds for a user, open the user’s details and go to Remote credentials.

To learn more, see Token Vault.

A virtual key is an API key that lets a caller use AI Gateway. For example, an organization with one Anthropic API key can generate a virtual key for each Claude Code user instead of sharing the real key. The user holds the virtual key, while the provider API keys stay in Token Vault instead of in your apps.

Use virtual keys to:

• Reinforce API key security: Virtual keys can be generated and deleted.
• Attribute and control costs: Requests made with a personal virtual key are attributed to its holder. The spend limits set on the user apply to that traffic.

The gateway treats whoever holds the key as the caller.

To create a key, you provide a name and choose a user as the holder. You can also add a new user inline.

You can create a key in one of the following ways:

• Have AI Gateway generate the key. The key is shown once, after you create it.
• Set your own key value.

In both cases, you choose an expiry of 30 days, 90 days, 1 year, or never.

You can search the key list by name, filter it by type, and delete keys one at a time.

Rotating a key isn’t supported. To rotate a key, create a new one and delete the old one.