Api keys without organization

[vincent-tarrit]

Hello, I manage 10 organizations in my instance and i have to create api keys for each as they are scope by org.

However, i realize that i can generate api keys via api using the main api key. So i suggest that the scope is pointless right ? Why can't we create 1 api key that can handle all orgs ? Thank you for your clarification 😄

[vectornguyen76]

The scope isn't pointless, but it's not a security boundary between your organizations either. Here's how it works in the code:

• What the scope does. When a request comes in with x-api-key, validateRequest (packages/server/src/lib/auth.ts) reads organizationId from the key's metadata and builds the session with that as activeOrganizationId, using your role in that org. That's how every API call knows which org's projects and servers you mean. There's no header to switch orgs per request, so one key = one org context. A key without an organizationId is rejected.
• Why you can mint keys for other orgs. API keys belong to the user, not the org. user.createApiKey only checks that you're a member of the org you put in metadata.organizationId. So a key for org A can create a key for org B as long as you're a member of B. It can't reach orgs you don't belong to.

So in practice:

• If you manage all 10 orgs yourself, the simplest approach is what you found: use one key to call user.createApiKey once per org (with metadata: { organizationId }) and keep the 10 keys, e.g. in a small script. The endpoint is listed in the API reference / Swagger UI.
• Be aware this means a leaked key effectively gives access to every org that user is a member of. If you want real isolation, create keys from a dedicated user that is only a member of the org that key is for.

A single key with multi-org access (or a per-request org header) would be a feature request. Feel free to open one.