API keys

API keys connect your application to Averta’s runtime decision API. Every SDK wrapper call uses one Averta API key, and that key determines which policy applies.

Fast Path

Open the Averta Dashboard.
Go to API Keys.
Create a key for the environment or agent you are integrating.
Attach the policy you want to enforce.
Copy the secret immediately.
Set it as AVERTA_API_KEY in your app.
Run one guarded request and confirm an event appears.

The plaintext secret is shown once. If you lose it, create a new key and rotate your app configuration.

Runtime Usage

export AVERTA_API_KEY="your-averta-key"

Provider wrappers read this environment variable automatically. Use explicit wrapper key options only for unusual cases, such as selecting a different key for one client in the same process. OpenAI:

import OpenAI from "openai";
import { wrapOpenAI } from "@averta-security/sdk-openai";

let client = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY!,
});

client = wrapOpenAI(client);

import os

from openai import OpenAI
from averta_openai import wrap_openai

client = wrap_openai(OpenAI(api_key=os.environ["OPENAI_API_KEY"]))

Anthropic:

import Anthropic from "@anthropic-ai/sdk";
import { wrapAnthropic } from "@averta-security/sdk-anthropic";

let client = new Anthropic({
  apiKey: process.env.ANTHROPIC_API_KEY!,
});

client = wrapAnthropic(client);

Table Fields

Field	Meaning
Name	Human-readable key label.
Key	Masked key prefix for debugging.
Policy	Policy currently attached to the key.
Created by	User who created the key.
Created at	Creation timestamp.

Use names and prefixes that make Events easy to investigate. A key named prod-support-agent is more useful than new key.

Policy Attachment

A key without a policy is not ready for normal runtime enforcement. Attach a policy before using the key in an SDK integration. You can change the attached policy without changing application code, which is the reason policy attaches to the key instead of being hardcoded in the app.

Recommended Key Strategy

Boundary	Recommendation
Production	Separate key with a production policy.
Staging	Separate key with a staging policy.
Local development	Separate key if local traffic should be easy to filter.
Multiple agents	Separate keys when ownership, policy, or event investigation differs.
Retired apps	Delete or rotate keys immediately.

Do not share one catch-all key across every agent. It makes event investigation harder and policy changes riskier.

Troubleshooting

Symptom	Check
SDK returns `401`	Averta key is missing, malformed, or revoked.
SDK returns `403`	Key may not have an attached policy or may not be allowed for runtime decisions.
No events appear	Confirm the app is using this key and calling a supported wrapped method.
Production traffic appears under staging	Verify deployed environment variables.
Events are hard to correlate	Use clearer key names and pass `requestContext`.
A retired app still produces events	Delete or rotate the old key.

Access

Role	Key access
Owner	View, create, and delete keys.
Admin	View, create, and delete keys.
User	No API key management access.

Deleting a key revokes it immediately. Any integration still using that secret will stop making Averta decisions.

Get Started

Core Concepts

OpenAI

Anthropic

Dashboard

Advanced

Fast Path

Runtime Usage

Table Fields

Policy Attachment

Recommended Key Strategy

Troubleshooting

Access

Next Steps

Policies

Events

​Fast Path

​Runtime Usage

​Table Fields

​Policy Attachment

​Recommended Key Strategy

​Troubleshooting

​Access

​Next Steps

Policies

Events

Fast Path

Runtime Usage

Table Fields

Policy Attachment

Recommended Key Strategy

Troubleshooting

Access

Next Steps