To implement RBAC on your API keys in Permit.io, you can manage them at different hierarchical levels with role-based permissions. Permit.io provides three levels of API key management (1) : 1. ​*Organization Keys*​ - These reside at the top level, governing all organizational assets and projects, primarily accessible by top-level administrators 2. ​*Project Keys*​ - Tailored to individual projects or products, providing granular control over specific projects, typically granted to project managers and relevant team members 3. ​*Environment Keys*​ - Managing distinct project phases like Development, Testing, or Production, usually managed by developers and operations teams Environment-level API keys are automatically generated for new environments . You can create and manage these keys by navigating to the ​*Settings*​ on the Sidebar and clicking on the ​*API Keys*​ tab . For implementing RBAC with API keys in your application, you should combine them with a policy-based authorization model (2) . Rather than relying solely on OAuth scopes, use policy-as-code to define dynamic and flexible authorization rules by incorporating models like RBAC, ABAC, or ReBAC . This creates a more adaptable and scalable authorization system that interprets OAuth scopes within the context of detailed and context-sensitive policies . The Configuration Plane components that help define your RBAC policies include (3) : • ​*Roles*​ at both system and resource levels • ​*Resources*​ specifying possible actions users might undertake • ​*Policy*​ rules that determine whether access is allowed or denied based on roles and resources

To learn more, see the sources I considered: [[1] Workspace Settings](https://docs.permit.io/manage-your-account/workspace-settings) [[2] API Security: A Comprehensive Guide for Developers](https://www.permit.io/blog/api-security-a-comprehensive-guide-for-developers) [[3] Modeling and Implementation Components](https://docs.permit.io/how-to/SDLC/modeling-implementation-components)

You're absolutely right! For managing RBAC on their own application's API keys, they can treat API keys as users in Permit.io and assign roles to them. Here's how to implement this approach: Creating API Keys as Users In Permit.io, you can create API keys as users with the user creation methods. For example, in Java (1) :

import io.permit.sdk.openapi.models.UserCreate;
import io.permit.sdk.openapi.models.UserRead;

UserRead user = permit.api.users.create(
    (new UserCreate("auth0|elon") )
    .withEmail("<mailto:elonmusk@tesla.com|elonmusk@tesla.com>")
    .withFirstName("Elon")
    .withLastName("Musk")
) ;

Assigning Roles to API Keys Once created as users, you can assign roles to these API keys. In Java (2) :

RoleAssignmentRead ra = permit.api.users.assignRole("<mailto:elon@tesla.com|elon@tesla.com>", "admin", "tesla") ;

Or in Node.js (3) :

const response = await permit.api.assignRole(JSON.stringify(assignedRole) ) ;

Where the assignedRole payload would be :

{
    role: "role",
    tenant: "tenant", 
    user: "user"
}

This approach allows you to leverage Permit.io's full RBAC capabilities for your API keys, including role assignments at different resource levels and tenant boundaries (4) .

To learn more, see the sources I considered: [[1] permit.api.users.create()](https://docs.permit.io/sdk/java/user/create) [[2] permit.api.users.assignRole()](https://docs.permit.io/sdk/java/role/assign-role) [[3] assignRole](https://docs.permit.io/sdk/nodejs/role/assign-role) [[4] Modeling and Implementation Components](https://docs.permit.io/how-to/SDLC/modeling-implementation-components)

how do i diffrentiate between real users and api key users

with easy identification

To differentiate between real users and API key users in Permit.io for easy identification, you can use the user's

key

parameter with a naming convention. When creating users via the SDK or API, the

key

parameter is "A unique ID by which Permit will identify the user for permission checks" (1) . This key must be "url-friendly (slugified) " and can be "anything for this ID - the user email, a UUID, or anything else as long as it's unique on your end" . For API key users, you could use a specific prefix in the key. Here's how to create users with distinct identifiers: ​*For regular users:*​

{
  "key": "user|892179821739812389327",
  "email": "<mailto:jane@coolcompany.com|jane@coolcompany.com>",
  "first_name": "Jane",
  "last_name": "Doe"
}

​*For API key users, you could use a pattern like:*​ •

apikey|service-name-123

•

service|payment-gateway

•

bot|automation-worker

You can also use the

attributes

field to add metadata that identifies the user type :

{
  "key": "apikey|payment-service",
  "email": "<mailto:service@example.com|service@example.com>",
  "first_name": "Payment",
  "last_name": "Service",
  "attributes": {
    "user_type": "api_key",
    "service": "payment_gateway"
  }
}

This approach makes it easy to identify API key users at a glance in the User Management screen (2) and when querying users programmatically.

To learn more, see the sources I considered: [[1] Sync Users](https://docs.permit.io/how-to/sync-users) [[2] Policy Basics](https://docs.permit.io/how-to/build-policies/policy-basics)