Key facts
| Single sign-on | SAML 2.0 / OIDC SSO on Enterprise |
| Provisioning | SCIM user provisioning and deprovisioning on Enterprise |
| Permission model | RBAC with workspace, role and resource-level permissions |
| API keys | Scoped keys per project, environment or tenant; per-key rate limits and quotas |
| Audit logs | Request and admin events export to SIEM (Splunk, Sentinel, QRadar, Datadog) |
| Key custody | BYOK via AWS KMS, Azure Key Vault, HashiCorp Vault or an on-prem HSM |
| Compliance | SOC 2 Type II under NDA, ISO 27001/27017/27018, HIPAA with a BAA; FedRAMP Moderate in process |
| Deployment | Hosted, VPC, on-prem and air-gapped with the same API |
TL;DR
- Avoid the three expensive mistakes: shared keys, no logs, personal credentials.
- Scoped keys per environment cost an afternoon and pay off for years.
- Turn audit logging on before you need it.
- Add roles, then SSO and SCIM, as enterprise demand appears.
- Each step is additive — no rewrite, same OpenAI-compatible API.
How it works, step by step
- Create a scoped key per environment and store it in a secret manager.
- Remove keys from code, notebooks and chat messages.
- Enable audit logging and confirm you can trace a request to a key.
- Define staff roles when more than two people touch production.
- Set per-key quotas so a bug cannot drain your usage.
- Enable SSO and SCIM when the first enterprise contract requires them.
- Review the security page each time a control lands.
Try it yourself
Open the AI API key security checklist →
Why startups need an access model
Early-stage teams should not build an identity platform. They should avoid the three mistakes that are expensive to unwind: one shared production key, no audit trail, and a founder's personal account holding every credential. Everything else can wait for customers.
The good news is that the cheap version of access control is also the correct foundation. Keys per environment take an afternoon. Logging switched on early costs nothing later. Roles and SSO can arrive when the first enterprise security review asks for them — and it will.
The four layers: identity, permission, keys, evidence
Think in terms of who, what, which and proof. Who is federated identity — SAML 2.0 / OIDC SSO on Enterprise, with SCIM keeping the user list current. What is authorisation — RBAC with workspace, role and resource-level permissions. Which credential is in use — scoped API keys per project, environment or tenant, with per-key rate limits and quotas. Proof is the audit trail — request and admin events exported to your SIEM, retained up to 7 years. For startups, the first two layers — scoped keys and a working audit trail — are cheap now and disproportionately expensive to retrofit later.
Controls startups should configure first
Work through four levels as demand arrives. Level one: scoped keys per environment — dev, staging, production — stored in a secret manager, never in code. Level two: audit logging on, so you can answer 'what happened?' during an incident or a customer question. Level three: workspace and role separation for staff, with per-key quotas. Level four: SAML/OIDC SSO and SCIM when an enterprise contract requires federated identity and automated deprovisioning.
BYOK and private deployment come after that, when a buyer's data policy demands them; the API stays the same, so none of these steps force a rewrite.
A practical rollout order
Start today with level one and two, which take hours rather than weeks. Prototype on the free plan with plugsky-micro and plugsky-lite, and keep the security page current as each level lands so due diligence is a link, not a project. See the live pricing page for current plans.
Honest comparison
| Control | Plugsky | Shared API keys only | Building in-house |
|---|---|---|---|
| Single sign-on | SAML 2.0 / OIDC on Enterprise | Not available | You integrate the IdP |
| Deprovisioning | SCIM on Enterprise | Manual key deletion | Custom lifecycle jobs |
| Permission granularity | Workspace, role and resource-level | One key for everything | You build the model |
| Key scoping | Per project, environment or tenant, with quotas | Shared key, no attribution | Custom key service |
| Audit evidence | Request and admin events with SIEM export | Limited request logs | You build the pipeline |
| Key custody | BYOK via KMS or on-prem HSM | Provider-managed keys | You operate the HSMs |
Frequently asked questions
Is it too early for RBAC at seed stage?
Full RBAC, yes. But scoped keys and logging are cheap now and painful to retrofit later, and they are the first things enterprise buyers ask about.
What is the fastest way to pass a security questionnaire?
Have a current security page, scoped keys with owners, audit logging enabled, and clear answers on residency and data handling. Most questionnaires are answered by documented defaults.
Do we need the OpenAI SDK to change?
No. Authentication and access control sit alongside the same OpenAI-compatible API, so application code keeps working when keys or roles change.
Is there a free plan?
Yes — plugsky-micro and plugsky-lite with 2 API keys and no credit card. A 14-day full-access trial is also available.
How is pricing structured?
Self-serve plans are flat monthly with unlimited fair-use usage and no per-token charges or overage fees. See the live pricing page for current plans.
Can we keep our own identity provider?
Yes on Enterprise: SAML 2.0 / OIDC SSO and SCIM provisioning work with standard identity providers, and RBAC maps your roles to workspace and resource permissions.