Upcoming automatic revocation of unused API keys

Starting November 5, 2026, Baseten will automatically revoke API keys that haven’t authenticated a request in 90 days. This change is part of our ongoing work to strengthen workspace security and reduce the risk from unused credentials. Keys that remain unused for 90 days will continue to be revoked on an ongoing basis.
Before enforcement begins, review the last-used timestamp for each key on your API keys page. Rotate any keys used by infrequent workloads and update those workloads with the replacement keys. If your team provisions keys through automation, review those workflows as well.

Revoked keys cannot be restored. Requests using a revoked key will fail authentication.

For more information, see our documentation.