Sign-in and automation keys

Workspace keys for CI and services#

Create an account, verify your email, then create a workspace API key with only the permissions it needs. Set these through your secret manager or a private shell environment:

• EVALROUTER_API_KEY: the key's secret value.
• EVALROUTER_WORKSPACE_ID: its workspace's ID.
• EVALROUTER_BASE_URL: https://api.evalrouter.ai, without /v1.

Keep keys out of command arguments, URLs, source control, screenshots and shared logs. A key grants only its workspace permissions. It doesn't add credit or make an unavailable evaluation runnable. A device sign-in can read the credit balance but can't create keys, add credit or change billing settings.

Manage keys#

• A key belongs to its workspace, not its creator, so it keeps working if they leave or change role.
• The API keys page shows who created each key and when it was last used. Revoke keys you no longer need.
• To replace a key, roll it: the new key has the same permissions, and the old one keeps working for up to seven days.
• You're emailed a week before a key expires. EvalRouter revokes a key automatically when it appears in public code.
• A key has permissions, not a role. An admin-only action also needs the key's write permission: eval:write, or billing:write for billing. A read-only key can't use it.

If a key fails, check its status and workspace before retrying. Don't start an evaluation to diagnose authentication. Next: the CLI quickstart.