Hosted customer: sign in, create and revoke a key

Role: hosted customer. The separate account page contains your own keys and limits. Policy, masking and organization administration belong to the deployment operator; signing in through SSO does not grant those rights.

Open the console address supplied by your operator. For the public service, use IAM.Secure. Staging uses a separate account and API endpoint; never use its address in production configuration.
Choose Sign in with corporate SSO / Войти через корпоративный SSO. Complete IAM.Identity sign-in. If terms appear, review and accept them yourself before proceeding.
Confirm your own account name and the API address displayed in the card. A console login does not configure another product’s membership.

Create and save a key

Click Create API key / Создать API-ключ once. Wait for the response; do not click repeatedly while it is busy.
Save the one-time value in your application’s secret store. Hide / Скрыть removes it from the page. The ID in the list is not the credential.
Reload the page: the key ID remains while the secret is no longer displayed. There is no extra Save button and no editable Tenant ID in this customer form.

**Hosted customer account: saved key with its secret hidden**
2026-10-15 · Working staging and normal synthetic-customer SSO. The key was created in the account, read after reload, used for an API request and revoked; the old key returned 401. Only its ID is visible; the secret is hidden. This is not a production account.

Check a request

Set IAM_API_BASE to the API address shown in your account (including /v1) and IAM_API_KEY from a private secret store. Do not put the key into a URL, ticket or screenshot. This example inspects a synthetic question without generating a provider response; the classifier can itself use Tier 3 LLM.

curl --fail-with-body "$IAM_API_BASE/inspect" \
  -H "Authorization: Bearer $IAM_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"messages":[{"role":"user","content":"What is the capital of France?"}],"context":"docs-client-qualification"}'

Check verdict and decision, including request ID, action and policy/rule where present. HTTP 200 means inspection completed; it does not promise allow, model generation or zero false positives. The 2026-10-15 staging test returned a Router route decision; Secure classified this public question CONFIDENTIAL and returned reroute. That discrepancy was reported to the operator.

Limits and access

Monthly requests (UTC) is usage / monthly limit. Requests per second is the sustained rate; burst is the short-burst allowance. Zero limit is shown as ∞ in this UI.
These values are read-only for the customer. Request changes from the operator, then reload and compare. Ask for the intended access state and new values explicitly.
Suspending customer access is different from pausing a policy. Pausing one policy leaves other policies active; the customer cannot disable them from this page.

Revoke and verify

Stop the application’s use of this key or configure its replacement privately.
Find the exact ID and click Revoke / Отозвать. Wait until that row disappears.
Reload and verify it stays absent. A new request with the old key must return HTTP 401; signing out alone does not revoke a key.

The real staging test created one key in each product, verified full-reload persistence and authenticated requests, then revoked both in the UI. Both old keys returned 401. Only a synthetic account was used; the image contains no secret.

Recovery

Sign in through IAM.Identity after clicking: the session may have expired while the old page remained visible. Sign out, repeat SSO and verify your own account before retrying; first check whether a row was already created.
Account not connected: the operator must connect this Identity account to this product. Do not create another account or grant yourself operator roles.
Access suspended: ask the operator to restore access; retry a fresh sign-in afterwards.
HTTP 401: check the API address, correct product key and revocation. HTTP 429: check monthly/rate limits with the operator. Do not increase privileges to bypass either failure.
No Policies/Masking menu: this is the expected hosted-customer page. Use operator settings to discuss the required change with your operator.

Operator: save limits and suspend access

Клиенты · администрирование → find the exact customer → open the row. Set Запросов в месяц (UTC), Запросов / секунду, Burst, then Сохранить настройки. Reload the whole page, find the same ID and compare the form. The customer must reload their separate account page to see the values.

**Customer: saved limits 90 / 8 RPS / burst 16**
2026-10-15 · Working staging, synthetic customer only. Values were saved in the form, read after a full reload and shown to the customer. Sign-in suspension and restoration were checked separately; final values were restored to 100 / 10 / 20 with access enabled. No emails were sent.

To suspend, clear Доступ разрешён → Сохранить настройки, read it back and check a fresh customer sign-in. To restore, enable that field and save, then sign in again. In this check the actual customer saw 90/8/16, suspension denied sign-in, and final state was restored to enabled 100/10/20. Notifications remained off; no invitations or update emails were sent.

If an operator tab shows 403 after a customer signed in in another tab, sign the customer out and restore the intended operator session. The displayed role badge alone does not prove the effective server session; do not grant broader permissions to work around it.

Sign in