SaibleDocs
Access

Keys and who holds them

Five keys. Each one opens one door.

YOUR NETWORKA toolSaible gateway144 signs every record inside the gatewayProvidersyour keys2Saiblecontrol planeyour region355 signs the policy bundle that every gatewaypulls and checks before using it
Five keys, one door each
  • 1Tool key
    sk-saible-…a tool → the gatewaythe tool's owner or an org admin rotates or revokes itrotation keeps the old key for an overlap (7 days by default); an optional maximum age
  • 2Provider keys
    yoursthe gateway → your providersyou hold them; they stay in your networkSaible never receives them
  • 3Gateway credential
    sk-saible-gw-…the gateway → Saiblean org admin issues it on Gateways, shown onceexpires after 365 days; rotate or revoke it there
  • 4Instance key
    Ed25519signs each recordmade inside each gateway instancenever leaves the process; its public key goes to Saible
  • 5Bundle key
    Ed25519signs the policy bundleSaible's own signing keyeach gateway pins Saible's root key at install and accepts only signing keys that root announced, so the signing key rotates without touching your install
Do it
  1. 1On Registry, register a tool. Its Saible key is shown once.
  2. 2Give the tool that key as its API key: the gateway reads x-api-key or Authorization: Bearer.
  3. 3On the tool's page, rotate its key; the old one keeps working for the overlap.
  4. 4On Gateways, issue each gateway's credential and keep it in your secrets store.
For your agents

This topic is also written as Agent Skills your agents can load: registry, gateways, settings. Ask us for them.

Next · Control Plane · CoverageControl coverage, in seven areas →