Keys & Auth
Dobby uses a few credential families, each with its own prefix and purpose. This page tells you which one you need, how to get it, and how to keep it safe.
Which key do I use?
- • Sending telemetry from your agent via the Collector SDK → the
dsdk_token from the Connect wizard. - • Calling the gateway / MCP execute tools from a local client → a
gk_user_key. - • A machine / BYOA integration against the gateway → a
gk_svc_key. - • The REST API or inline Control Point → an
sk_live_tenant key. - • Driving Dobby over remote HTTP as a person → a
dobby_pat_personal token.
The key families
Gateway key — User
gk_user_…A person driving the LLM gateway or MCP execute tools (typically local STDIO). Works for read + execute.
Default scopes: llm:*, mcp:read, mcp:execute
Gateway key — Service
gk_svc_…Machine / service integrations — BYOA external agents, CI. Can also manage keys.
Default scopes: llm:*, mcp:read, mcp:execute, keys:manage
Gateway key — Temporary
gk_tmp_…Short-lived; minted server-side from your session over the remote HTTP transport. You rarely create one yourself.
Default scopes: llm:completions
Tenant API key
sk_live_…The REST API and the inline Control Point (controls.check / controls.enforce). Control Point routes accept only sk_live_.
Default scopes: API_SCOPES (e.g. agents:write, controls:*)
Personal Access Token
dobby_pat_…A person driving Dobby over the remote HTTP transport (mcp.dobby-ai.com). Carries no tenant — mirrors your live RBAC.
Default scopes: Your RBAC across your tenants/orgs
Collector token
dsdk_…Telemetry-only — authenticates the Collector SDK against the ingest webhook. Minted once by create_workload / the Connect wizard.
Default scopes: telemetry:ingest (not a gateway key)
Where to get one
- • Gateway keys — Dashboard → Gateway → Keys
- • Tenant keys (
sk_live_) — Settings → API Keys - • Personal tokens — Settings → Personal Tokens
- • Collector token — the Workloads → Connect wizard (shown once)
Rotation & safety
- • All keys are stored SHA-256-hashed and shown in full only once.
- • Gateway keys: rotate via the keys API, or let the TTL expire.
- •
sk_live_/dobby_pat_: revoke and mint a new one. - • Collector token: recreate the workload to rotate.
- • An org-level kill-switch revokes all gateway keys within seconds.