docs(iam): add Manage API keys page for org-scoped keys and creation controls - #3060
Open
mdlinville wants to merge 3 commits into
Open
docs(iam): add Manage API keys page for org-scoped keys and creation controls#3060mdlinville wants to merge 3 commits into
mdlinville wants to merge 3 commits into
Conversation
…controls Adds a primary page for API key management covering the consolidated API Keys tab, the key visibility model by role, and the two admin settings that restrict key creation and use. Deployment split verified against wandb/core master and server-release-0.83.x: - requireOrgScopedAPIKeys is Multi-tenant Cloud only, Enterprise non-academic orgs, behind a per-org Statsig gate. - disableApiKeyCreation is Dedicated Cloud and Self-Managed only, new in v0.84.0. - Search, filter, key creation, and bulk delete in the API Keys tab are new for Dedicated Cloud and Self-Managed in v0.84.0. Also disambiguates "organization-scoped API key" from "organization-scoped service account", which the docs already used for a different concept. Refs DOCS-3071, WB-25038, WB-37180 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
Contributor
Readability impactWord-weighted Flesch-Kincaid grade change across 3 changed pages: +0.0 (unchanged). Lower Flesch-Kincaid grade and higher reading ease both mean easier to read. This check is informational and never blocks a PR. Human readability
AI agent comprehensionRated 0-3 (higher is easier for an agent to parse and act on).
Curated-docs baseline median FK grade by type: conceptual 10.5, procedural 8.8, reference 9.4. |
Contributor
📚 Mintlify Preview Links✨ Added (1 total)📄 Pages (1)
📝 Changed (4 total)📄 Pages (3)
⚙️ Other (1)
🤖 Generated automatically when Mintlify deployment succeeds |
Contributor
🔗 Link Checker Results✅ All links are valid! No broken links were detected. Preview: https://wb-21fd5541-docs-3071-org-scoped-api-keys.mintlify.site |
mdlinville
commented
Aug 11, 2026
- Give step-wise UI navigation to the API Keys tab for both Multi-tenant Cloud and the onprem Organization Dashboard, reusing the URL patterns already used in org_dashboard.mdx. - Correct the billing admin claim. The tab is hidden for the BILLING_ONLY org role in Multi-tenant Cloud only; the onprem Organization Dashboard renders the tab with no billing guard. - Add a billing admin row to the visibility table. - Add "Rotate an API key". W&B has no single rotate action, so the section documents the create, migrate, verify, delete workflow. - Add "Rename an API key" for the row Edit action. - Replace the inferred single-key delete wording with the actual control: the row actions menu offers Edit and Delete. Refs DOCS-3071 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
HiveMind Sessions1 session · 46m · $23
Screenshots
View all sessions in HiveMind → Run |
mdlinville
commented
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a primary Manage API keys page and links the existing API key content to it. Drafted ahead of the 0.84.x branch cut so that technical feedback can still reach the code.
Related: DOCS-3071, WB-25038, WB-37180, DOCS-2902
DO NOT MERGE this PR until Dedicated rollout of 0.84.0, scheduled for 8/19.
Why now
disableApiKeyCreationis inmasterand is not inserver-release-0.83.x, so 0.84.0 is its first release. Reviewing this before the cut means any correction can still land in the release rather than in a follow-up.What changed
platform/hosting/iam/api-keys.mdxplatform/app/settings-page/user-settings.mdxplatform/hosting/iam/service-accounts.mdxplatform/hosting/iam/advanced_env_vars.mdxGORILLA_DISABLE_TEAM_SERVICE_ACCOUNT_CREATIONto the new page.docs.jsonWhy a new page
The product consolidated key management into one API Keys tab covering personal, organization-scoped, team service account, and organization service account keys under a single visibility model. Our docs split that across user settings (personal) and service accounts (service accounts). The new page matches the product; the existing pages now point at it.
It also gave the terminology problem somewhere to live: the docs already used "organization-scoped" for service accounts, which is a different concept from an organization-scoped API key held by a person.
Deployment split as documented
Derived from
wandb/coremastervsserver-release-0.83.x. Please confirm this table above all else.requireOrgScopedAPIKeysdisableApiKeyCreationReasoning:
showCreateKey = (envIsPublicCloud && canCreateOrgScopedKeys) || !envIsPublicCloud, so create and multi-select are unconditional on onprem, while the search field and filter bar render unconditionally everywhere.useStatsigGateCreateOrgScopedKeysresolves to?? false, so the owner-type column stays hidden on onprem.There is no key rotation action
Worth flagging on its own. The row actions menu contains only Edit and Delete, and
EditApiKeyDrawer.tsxedits only the Name field. Nothing regenerates a secret in place.The page therefore documents rotation as a manual create, migrate, verify, delete workflow, and states plainly that both keys work until the old one is deleted. If a rotate capability is planned, this section should change shape — and given that key rotation is exactly what the NVIDIA and Canva requests are about, it may be worth knowing whether its absence is deliberate.
Deliberately not documented yet
Two things are omitted pending confirmation, so absence here is intentional rather than an oversight:
/authorizenow issuing organization-scoped keys. Not documented because the behavior for orgs where the gate is off is unconfirmed, and this is thewandb loginpath.Questions for review
disableApiKeyCreationintentionally settable only throughupdateOrganizationPrivacySettings, with no admin UI and no environment variable? This documents a raw GraphQL mutation as an admin procedure, which has no precedent elsewhere in these docs.GORILLA_DISABLE_TEAM_SERVICE_ACCOUNT_CREATION(DOCS-2902) went the environment variable route for the sibling control, so readers will look for an equivalent here. If an env var or UI is planned, the page should wait for it.API key creation has been disabled by your organization administratormatch what users see?isViewerBillingOnly, unrestricted in the onprem Organization Dashboard. Please confirm, since role behavior can change without anyone treating it as a docs-visible change.Resolved during review: the single-key delete control is now taken from the code rather than inferred from a screenshot.
Validation
validate-mdx-mintlify.sh validatepasses andmint broken-linksreports none, both on mint 4.2.792.🤖 Generated with Claude Code