An API key allows you to use Lehmus AI’s language models, RAG resources and preset agents through APIs and applications that use them.
An API key’s specific permissions are defined when it is created. A key can be granted permission to use a language model, read from or write to a RAG resource, or invoke a preset agent.
What you need before you start
You will need:
- Access to Lehmus AI
- Access to the Lehmus AI resources you want to use with the key
- A connection to the university network or VPN
An API key can only be granted permissions that the user already has.
Choose the API key type
Lehmus AI has two types of API key
Personal key
Personal key acts under your user identity. Use a personal key in your own scripts and integrations.
A personal key is tied to the user’s own permissions and stops working for any resources the user loses access to. A member of the tenant, or project, can create a personal key.
Service-account key
Service-account key is a key that is independent of any individual user. It is intended, for example, for shared project integrations and production workloads.
Only a project administrator can create a service-account key.
Create an API key
- Open API Keys in the Lehmus AI portal.
- Select Create key
- Give the key a descriptive name
- Select the key type (Personal/Service Account)
- Add the necessary permissions to the key for the language models, existing RAG endpoints or Preset Agents you want to use
- Click Create to create the key
- Copy the API key you have created straight away and store it somewhere secure.
The full API key is only shown when it is created. After that, the portal retains only a short prefix used to identify the key.
You can also open the Create API key function from a service’s own page, such as the page for a model or RAG resource. In this case, the permission for that resource is pre-filled in the form.
Please note that the key’s permissions cannot be changed after it has been created. If you need different permissions, create a new API key.
Store your API key securely
An API key serves as an authentication credential. Keep it secret.
- Do not share your API key with another user
- Do not store the key in source code
- Do not add the key to version control
- Do not include the key in a support request
- Only enter the key in the application setting intended for it
Rotate the key
If you need to change the secret part of the key, open the key in the Lehmus AI portal and use the Rotate function.
Rotate creates a new secret part while keeping the old one valid for a short overlap period. This allows you to replace the key in the integration before the old one stops working.
Revoking an API key
If an API key is no longer needed or has been compromised, open the key in the Lehmus AI portal and select Revoke.
Revoke disables the key immediately and permanently.
Check API key usage
The API key page has a Usage tab where you can view the key’s token usage over a selected period. The view breaks down input, output, embedding and rerank tokens, among others. Users can view usage for their own personal keys. Project administrators can also view usage for the project’s service-account keys.
Using an API key
In Model Gateway calls, the API key is sent as a bearer token in the Authorization header. Each request requires an API key with invoke permission for the model being used.
You can find more examples in the guide Lehmus AI: Using the APIs – ict.oulu.fi.