Projects and tenants
Control product access and isolate resources with project and tenant credentials.
A project owns keys, enabled products, usage and the linked billing account. Use separate projects for environments whose billing and credentials should be independent.
API keys select their project automatically. OAuth requests can supply X-Project-Id; the caller must have access to that project. X-Tenant-Id selects a tenant public ID, and the gateway validates its ownership and status. A tenant header never grants access to another project.
Keys grant scopes; product enablement remains a separate check. Revoke unused keys and OAuth apps. Never use a console login token as an AI API credential.
AI checks credential revocation, expiry, OAuth app status, membership, project status, tenant ownership/status and the billing link before paid submission, including queued work. Owner-managed model allowlists and per-project/per-tenant quotas can further restrict access. See AI controls.
Administrative console endpoints live under /api/v1 on the console API service; product endpoints use /v1 on the public gateway. Do not send a project API key to a console account-management endpoint.