---
title: Managing virtual keys in AI Runtime Control
summary: >-
Create, edit, refresh, and revoke the virtual keys that route traffic through
AI Runtime Control (ARC), and view each key's details.
url: >-
https://www.fastly.com/documentation/guides/platform/ai-runtime-control/managing-virtual-keys
---
AI Runtime Control (ARC) issues virtual keys that your applications and developers use in place of raw provider keys. Because every request carries the virtual key that made it, ARC can attribute usage to each key, giving you a single place to issue, rotate, and retire the credentials your AI traffic uses. This guide describes how to create, edit, refresh, and revoke virtual keys, and how to view keys that have been deleted or have expired.
## Prerequisites
To manage virtual keys, you must be assigned the [superuser role](https://www.fastly.com/documentation/guides/account-info/user-and-account-management/about-user-roles-and-permissions/). Other account roles can't access ARC.
## Create a virtual key
To create a virtual key, follow these steps.
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Tools** > [**AI Runtime Control**](https://manage.fastly.com/ai-runtime-control/summary).
3. Click the **Virtual keys** tab.
4. Click **Add key**.
5. In the **Key name** field, enter a human-readable name for the key.
6. _(Optional)_ To configure a failover provider, from the **Select provider** menu in the **Provider Routing & Failover** area, select a provider as your primary target for this virtual key.
7. _(Optional)_ Click **Add failover** for as many providers as needed for this key and then select the provider from the **Select provider** menu that appears with each one.
> **HINT:** Reorder the priority of the providers in the list by clicking the two horizontal lines 
to the left of the provider name and dragging that provider up or down.
8. In the **Expiration** area, do one of the following:
- To create a virtual key that never expires, select **Never expires**.
- To create a virtual key with an expiration date, select **Set expiration** and choose an expiration date from the date controls that appear.
9. _(Optional)_ To configure a monthly spending cap for this key, click **Add budget limit** and then:
- In the **Monthly budget limit (USD)** field, enter the budgeted dollar amount, in US dollars, that this key's spending should be limited to each month.
- From the **Action** menu, select **Alert** to send a notification to all Superusers on your account or select **Alert & Block** to send the notification and block further use of that virtual key.
- Click **Add budget limit**.
- Repeat the budget limit creation steps to set an additional limit with a different action.
10. _(Optional)_ To configure a request or token rate limit for this key, click **Add rate limit** and then:
- From the **Limit metric** menu, select either **Requests per minute** or **Tokens per minute** as the measurement metric for rate limiting this key.
- In the **Threshold** field, enter a whole number between 1 and 10,000,000 as the rate limit cap for the metric you selected.
- Click **Add rate limit**.
- Repeat the rate limit configuration steps to set an additional rate limit for another metric.
11. _(Optional)_ Click the **AI Firewall** switch to the **On** position to enable security inspection for your AI request traffic and then do one of the following to control what happens when a request matches a known injection pattern:
- select **Log** (the default) to have ARC record the detection and forward the request.
- select **Block** to have ARC reject requests before they reach your provider.
> **NOTE:** Security inspection is provided by AI Firewall, a separately purchased add-on to ARC.
12. Click **Add virtual key**. A key value and its creation notification appears.
13. Click **Copy key** or the clipboard 
to copy the virtual key save it in a safe location.
> **IMPORTANT:** This is the only time the key will be visible. Record the key and keep it secure. For your security it will not appear in the control panel.
Once created, the virtual key will appear in the list of keys on the Virtual keys tab. If you've enabled AI Firewall, a shield icon appears to the left of that virtual key's name.
## Edit a virtual key
You can update a virtual key's details without changing its value. To edit a virtual key, follow these steps.
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Tools** > [**AI Runtime Control**](https://manage.fastly.com/ai-runtime-control/summary).
3. Click the **Virtual keys** tab.
4. Click the three dots 
to the right of the virtual key that you want to edit and then click **Edit**.
5. In the **Key name** field, enter a human-readable name for the key.
6. _(Optional)_ To edit or configure a monthly spending cap for this key, click **Add budget limit** and then:
- In the **Monthly budget limit (USD)** field, enter the budgeted dollar amount, in US dollars, that this key's spending should be limited to each month.
- From the **Action** menu, select **Alert** to send a notification to all Superusers on your account or select **Alert & Block** to send the notification and block further use of that virtual key.
- Click **Add budget limit**.
- Repeat the budget limit creation steps to set an additional limit with a different action.
7. _(Optional)_ To edit or configure a request or token rate limit for this key, click **Add rate limit** and then:
- From the **Limit metric** menu, select either **Requests per minute** or **Tokens per minute** as the measurement metric for rate limiting this key.
- In the **Threshold** field, enter a whole number between 1 and 10,000,000 as the rate limit cap for the metric you selected.
- Click **Add rate limit**.
- Repeat the rate limit configuration steps to set an additional rate limit for another metric.
8. _(Optional)_ Click the **AI Firewall** switch to the **On** position to enable security inspection for your AI request traffic and then do one of the following to control what happens when a request matches a known injection pattern:
- select **Log** (the default) to have ARC record the detection and forward the request.
- select **Block** to have ARC reject requests before they reach your provider.
> **NOTE:** Security inspection is provided by AI Firewall, a separately purchased add-on to ARC.
9. Click **Save**. The virtual key will appear in the list of keys on the Virtual keys tab. If you've enabled AI Firewall, a shield icon appears to the left of that virtual key's name.
## Refresh a virtual key
You refresh a virtual key to rotate its value, for routine key hygiene or if a key may have been exposed. Refreshing issues a new key value while preserving the key's identity and its accounting history, so the usage attributed to the key stays intact. After you refresh a key, update the application or person that uses it with the new value.
To refresh a key, follow these steps.
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Tools** > [**AI Runtime Control**](https://manage.fastly.com/ai-runtime-control/summary).
3. Click the **Virtual keys** tab.
4. Click the three dots to the right of the virtual key that you want to edit and then click **Refresh**.
5. Click **Copy key** or the clipboard to copy the virtual key save it in a safe location.
> **IMPORTANT:** This is the only time the key will be visible. Record the key and keep it secure. For your security it will not appear in the control panel.
## Revoke a virtual key
When a key is no longer needed, you can revoke it. After a key is revoked, requests that use it are no longer routed. To revoke a virtual key, follow these steps.
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Tools** > [**AI Runtime Control**](https://manage.fastly.com/ai-runtime-control/summary).
3. Click the **Virtual keys** tab.
4. Click the three dots to the right of the virtual key that you want to edit and then click **Delete**.
5. Confirm the revocation when prompted. The key is revoked and requests that use it are no longer routed.
## View a virtual key's details
Each virtual key has a details page that shows its metadata and usage. The metadata includes when the key was created, when it was last used, who created it, when it expires, the models it maps to, and whether or not AI Firewall has been enabled for it. The **Metrics** area shows requests and tokens for the key across a date range you select. To download a CSV copy of the metrics, click **Export**.
To view a key's details, follow these steps.
1. Log in to the [Fastly control panel](https://manage.fastly.com).
2. Go to **Tools** > [**AI Runtime Control**](https://manage.fastly.com/ai-runtime-control/summary).
3. Click the **Virtual keys** tab.
4. Click the name of the virtual key.
> **HINT:** By default, the keys list shows only active keys. To include deleted keys, select **Show deleted keys**. To include expired keys, select **Show expired keys**. You can select both.