API Key Concepts

Understand provider credentials, project keys, and cloud provider connections

Core Concepts

API Keys in Bud are split into three management domains.

1) Provider Credentials

Provider credentials are reusable secrets attached to provider types. They are used by workflows that require access to external model providers.

Operational traits:

• Dynamic credential fields based on provider metadata
• Provider-level search and filter support
• Deployment usage visibility in detailed drawer

2) Project API Keys

Project keys are scoped to a single project and include governance fields.

Governance traits:

• Expiry windows (30 or 60 days)
• Max budget limits
• Last-used tracking for lifecycle decisions

3) Cloud Provider Connections

Cloud providers (shown in dev mode) store credential sets for infrastructure provider integration.

Visibility and Secret Safety

Secrets are displayed using a secure interaction pattern:

1. Values are masked by default
2. User explicitly reveals value with visibility toggle
3. User can copy a value via copy action

Lifecycle Model

Data You Can Operate On

Credential Type	Primary fields	Common list columns
Provider	Name, type, provider-specific secrets	Credential name, provider name, deployments, created on
Project key	Name, project, expiry, max budget	Credential name, project, expiry, last used, max budget
Cloud provider	Provider, credential name, secret set	Provider, credential name, description, created on

Recommended Operating Pattern

Use provider credentials for external provider integrations.

Issue project keys per team/workload, not shared org-wide.

Set expiry and budget during creation to enforce governance from day one.

Review last-used metadata before rotating or deleting keys.