Managing virtual keys in AI Runtime Control

AI Runtime Control (ARC) issues virtual keys that your applications and developers use in place of raw provider keys. Because every request carries the virtual key that made it, ARC can attribute usage to each key, giving you a single place to issue, rotate, and retire the credentials your AI traffic uses. This guide describes how to create, edit, refresh, and revoke virtual keys, and how to view keys that have been deleted or have expired.

Prerequisites

To manage virtual keys, you must be assigned the superuser role. Other account roles can't access ARC.

Create a virtual key

To create a virtual key, follow these steps.

1. Log in to the Fastly control panel.
2. Go to Tools > AI Runtime Control.

3. Click the Virtual keys tab.

4. Click Add key.

5. In the Key name field, enter a human-readable name for the key.

6. (Optional) To configure a failover provider, from the Select provider menu in the Provider Routing & Failover area, select a provider as your primary target for this virtual key.

7. (Optional) Click Add failover for as many providers as needed for this key and then select the provider from the Select provider menu that appears with each one.

   HINT: Reorder the priority of the providers in the list by clicking the two horizontal lines to the left of the provider name and dragging that provider up or down.

8. In the Expiration area, do one of the following:

   • To create a virtual key that never expires, select Never expires.
   • To create a virtual key with an expiration date, select Set expiration and choose an expiration date from the date controls that appear.

9. (Optional) To configure a monthly spending cap for this key, click Add budget limit and then:

   • In the Monthly budget limit (USD) field, enter the budgeted dollar amount, in US dollars, that this key's spending should be limited to each month.
   • From the Action menu, select Alert to send a notification to all Superusers on your account or select Alert & Block to send the notification and block further use of that virtual key.
   • Click Add budget limit.
   • Repeat the budget limit creation steps to set an additional limit with a different action.

10. (Optional) To configure a request or token rate limit for this key, click Add rate limit and then:

    • From the Limit metric menu, select either Requests per minute or Tokens per minute as the measurement metric for rate limiting this key.
    • In the Threshold field, enter a whole number between 1 and 10,000,000 as the rate limit cap for the metric you selected.
    • Click Add rate limit.
    • Repeat the rate limit configuration steps to set an additional rate limit for another metric.

11. (Optional) Click the AI Firewall switch to the On position to enable security inspection for your AI request traffic and then do one of the following to control what happens when a request matches a known injection pattern:

    • select Log (the default) to have ARC record the detection and forward the request.
    • select Block to have ARC reject requests before they reach your provider.

    NOTE: Security inspection is provided by AI Firewall, a separately purchased add-on to ARC.

12. Click Add virtual key. A key value and its creation notification appears.

13. Click Copy key or the clipboard to copy the virtual key save it in a safe location.

    IMPORTANT: This is the only time the key will be visible. Record the key and keep it secure. For your security it will not appear in the control panel.

Once created, the virtual key will appear in the list of keys on the Virtual keys tab. If you've enabled AI Firewall, a shield icon appears to the left of that virtual key's name.

Edit a virtual key

You can update a virtual key's details without changing its value. To edit a virtual key, follow these steps.

1. Log in to the Fastly control panel.
2. Go to Tools > AI Runtime Control.

3. Click the Virtual keys tab.

4. Click the three dots to the right of the virtual key that you want to edit and then click Edit.

5. In the Key name field, enter a human-readable name for the key.

6. (Optional) To edit or configure a monthly spending cap for this key, click Add budget limit and then:

   • In the Monthly budget limit (USD) field, enter the budgeted dollar amount, in US dollars, that this key's spending should be limited to each month.
   • From the Action menu, select Alert to send a notification to all Superusers on your account or select Alert & Block to send the notification and block further use of that virtual key.
   • Click Add budget limit.
   • Repeat the budget limit creation steps to set an additional limit with a different action.

7. (Optional) To edit or configure a request or token rate limit for this key, click Add rate limit and then:

   • From the Limit metric menu, select either Requests per minute or Tokens per minute as the measurement metric for rate limiting this key.
   • In the Threshold field, enter a whole number between 1 and 10,000,000 as the rate limit cap for the metric you selected.
   • Click Add rate limit.
   • Repeat the rate limit configuration steps to set an additional rate limit for another metric.

8. (Optional) Click the AI Firewall switch to the On position to enable security inspection for your AI request traffic and then do one of the following to control what happens when a request matches a known injection pattern:

   • select Log (the default) to have ARC record the detection and forward the request.
   • select Block to have ARC reject requests before they reach your provider.

   NOTE: Security inspection is provided by AI Firewall, a separately purchased add-on to ARC.

9. Click Save. The virtual key will appear in the list of keys on the Virtual keys tab. If you've enabled AI Firewall, a shield icon appears to the left of that virtual key's name.

Refresh a virtual key

You refresh a virtual key to rotate its value, for routine key hygiene or if a key may have been exposed. Refreshing issues a new key value while preserving the key's identity and its accounting history, so the usage attributed to the key stays intact. After you refresh a key, update the application or person that uses it with the new value.

To refresh a key, follow these steps.

1. Log in to the Fastly control panel.
2. Go to Tools > AI Runtime Control.

3. Click the Virtual keys tab.

4. Click the three dots to the right of the virtual key that you want to edit and then click Refresh.

5. Click Copy key or the clipboard to copy the virtual key save it in a safe location.

   IMPORTANT: This is the only time the key will be visible. Record the key and keep it secure. For your security it will not appear in the control panel.

Revoke a virtual key

When a key is no longer needed, you can revoke it. After a key is revoked, requests that use it are no longer routed. To revoke a virtual key, follow these steps.

1. Log in to the Fastly control panel.
2. Go to Tools > AI Runtime Control.
3. Click the Virtual keys tab.
4. Click the three dots to the right of the virtual key that you want to edit and then click Delete.
5. Confirm the revocation when prompted. The key is revoked and requests that use it are no longer routed.

View a virtual key's details

Each virtual key has a details page that shows its metadata and usage. The metadata includes when the key was created, when it was last used, who created it, when it expires, the models it maps to, and whether or not AI Firewall has been enabled for it. The Metrics area shows requests and tokens for the key across a date range you select. To download a CSV copy of the metrics, click Export.

To view a key's details, follow these steps.

1. Log in to the Fastly control panel.
2. Go to Tools > AI Runtime Control.
3. Click the Virtual keys tab.
4. Click the name of the virtual key.