Developer keys
A developer key belongs to one person, one device and one team. Its requests are charged to that person and to the team’s project, it may call only the Code Assistant’s models, and it stops working on a date a tenant admin chose. Admins and builders create and revoke their own keys on the Connect an IDE tab; nobody can create a key in someone else’s name.
Who can do what
Section titled “Who can do what”| Role | What they can do |
|---|---|
| Admin, Builder | Create, list and revoke their own developer keys. |
| Admin | Set the key lifetime and the most keys per developer on the Settings tab. Revoke anyone’s key on Keys and budgets. |
| Admin, Auditor | See every developer’s keys and spend on Usage by developer. |
| End user, Reviewer | Cannot hold a developer key. |
What a key is
Section titled “What a key is”| Property | Value |
|---|---|
| Owner | The person signed in when it was created. |
| Team | One of the Code Assistant’s teams, chosen at creation. Requests are charged to that project and count against its budget. |
| Device name | A label you choose so you can tell keys apart, at most 64 characters. |
| Models | The chat, autocomplete and codebase search models chosen when the key was created, and nothing else. |
| Lifetime | The tenant’s Key lifetime, in days at creation: 1 to 365 days, 90 by default. |
| Limit | Each developer holds at most the tenant’s Keys per developer active keys: 1 to 50, 5 by default. |
The key is shown once, when it is created, and cannot be retrieved afterwards. Olympusx AI keeps only what it needs to recognize it.
Create a key
Section titled “Create a key”- Open Use cases › Code Assistant on the Connect an IDE tab.
- Under 1. Create your key, choose your Team. Team is the project your work is charged to.
- Enter a Device name, for example
Work laptop. - Select Create key.
- Copy the key with Copy the key, then select I have copied it. Until you leave the page, the key is also written into the configuration under 2. Configure your tool.
Create one key for each machine you code on. A lost laptop then costs one revoked key, not all of them.
If Olympusx AI refuses:
| Message | What to do |
|---|---|
| You already hold N active keys, the most a developer may. | Revoke a key you no longer use under Your devices, then create this one. |
| This team is no longer one the Code Assistant is turned on for. | Reload the page and choose another team. |
| The Code Assistant was turned off for this tenant. | Ask a tenant admin to turn it on. |
| No team to choose yet | A tenant admin has not chosen the teams in Settings. |
List your keys
Section titled “List your keys”Your devices lists the keys you hold, newest first, with Device (the team is shown under the device name), Key ID, Models, Status, Last used and Expires. The status is one of:
- Active: the key works.
- Expired: its lifetime is past. The gateway refuses it from that moment.
- Revoked: you, or an admin, revoked it. A revoked key stays listed for 30 days, then disappears.
Last used is updated at most once a minute.
Revoke a key
Section titled “Revoke a key”- Under Your devices, open the key’s actions menu and select Revoke.
- Confirm with Revoke.
The editor on that device stops working with the Code Assistant on its next request. This cannot be undone: create a new key to connect the device again. Revoking your own key sends no notification; the audit log records it.
A tenant admin can revoke any developer key on Keys and budgets.
What is checked on every request
Section titled “What is checked on every request”A developer key goes through the same gateway as any application key: the tenant’s grants, the key’s models, the team’s budget and the tenant’s rate limits apply. The guardrail policy applies under a profile made for code:
| Check | For a developer key |
|---|---|
| Secrets | Always on, on the prompt, whatever the policy says. A secret is redacted or blocked as the policy’s On PII (enforce) says; in Observe mode it is recorded and passes. |
| Prompt injection | Always on, on the prompt. Blocked or flagged as the policy’s On unsafe content (enforce) says. |
| Personal data | Off for code, so ordinary code such as s[::-1] reaches the model unchanged. |
| Toxicity and banned topics | Off for code, so words such as “kill”, “abort” and “execute” pass as the ordinary code they are. |
| Answers | Streamed back as they are written, without a scan or a hold, so autocomplete stays fast. |
These checks run when a platform admin has installed the guardrails service; without it, prompts pass unexamined, as they do for every key. Every audit entry written for a developer key’s request is marked with the code profile, so an auditor can tell why personal data was not redacted. Prompts and code from editors are never sampled for review and are not stored. See Guardrails.