To learn more, see the sources I considered: [[1] Troubleshooting](https://docs.opal.ac/getting-started/running-opal/troubleshooting) [[2] Permit's PDP (Policy Decision Point)](https://docs.permit.io/concepts/pdp/overview) [[3] Docker image errors out - cannot get config from control plane](https://github.com/permitio/PDP/issues/251)

* To set up a PDP with a ​*Project API Key*​, you need to understand the API key hierarchy and how to pass the environment context. ​*API Key Types*​ (1) : 1. ​*Organization API Keys*​ – Access your entire Permit workspace (all projects and environments) 2. ​*Project API Keys*​ – Access a single project and all environments within it 3. ​*Environment API Keys*​ – Access a single environment only. ​*Only this type can be used by the PDP container*​ ​*Important*​: The documentation states that only ​*Environment API Keys*​ can be used directly by the PDP container. ​*Recommended Approach*​: As mentioned by the team, using environment-level keys aligns with the least-privilege principle. For each PDP instance, use the environment-specific API key. ​*To run a PDP*​ (2) :

docker run -it \
  -p 7766:7000 \
  -p 8181:8181 \
  --env PDP_API_KEY=<YOUR_API_KEY> \
  --env PDP_DEBUG=True \
  permitio/pdp-v2:latest

​*To get your Environment API Key via API*​ (3) : First, get your project:

curl '<https://api.permit.io/v2/projects>' \
  -H 'authorization: Bearer API_SECRET_KEY'

Then get environments for that project:

curl '<https://api.permit.io/v2/projects/project_id_or_key/envs>' \
  -H 'authorization: Bearer API_SECRET_KEY'

You can also retrieve or manage environment API keys through the Settings -> API Keys screen in the dashboard. (1) ​*For multiple projects in the same EKS cluster*​: You would typically run separate PDP instances (or deployments) , each configured with its own environment-level API key for the specific environment it serves.

To learn more, see the sources I considered: [[1] Using the API](https://docs.permit.io/api/api-with-cli) [[2] Deploy Permit to Production](https://docs.permit.io/how-to/deploy/deploy-to-production) [[3] Overview](https://docs.permit.io/api/examples/get-project-and-env)

* You're right, my apologies! Here's how to run the PDP with a ​*Project API Key*​ or ​*Organization API Key*​: (1) ​*Using a Project API Key:*​ You need to set

PDP_PROJECT_API_KEY

and specify the environment with `PDP_ACTIVE_ENV`:

docker run -it \
  -p 7766:7000 \
  --env PDP_PROJECT_API_KEY=<YOUR_PROJECT_API_KEY> \
  --env PDP_ACTIVE_ENV=<YOUR_ENVIRONMENT_ID_OR_KEY> \
  --env PDP_DEBUG=True \
  permitio/pdp-v2:latest

​*Using an Organization API Key:*​ You need to set

PDP_ORG_API_KEY

and specify both the project and environment:

docker run -it \
  -p 7766:7000 \
  --env PDP_ORG_API_KEY=<YOUR_ORG_API_KEY> \
  --env PDP_ACTIVE_PROJECT=<YOUR_PROJECT_ID_OR_KEY> \
  --env PDP_ACTIVE_ENV=<YOUR_ENVIRONMENT_ID_OR_KEY> \
  --env PDP_DEBUG=True \
  permitio/pdp-v2:latest

This approach is useful when you want a single API key for multiple environments or to reduce secrets management overhead. However, as mentioned, environment-level keys are recommended from a least-privilege security perspective.

To learn more, see the sources I considered: [[1] Deploy Permit to Production](https://docs.permit.io/how-to/deploy/deploy-to-production)

currently we do have project/environment key set up on pdp

but ethan is trying to access a different project and hence the problem

* Got it — if Ethan needs to access a ​*different project*​, then the current PDP setup (configured for one project/environment) won't work for that other project. ​*The core issue*​: A single PDP instance is tied to ​*one environment*​ at a time. If you're using a Project API Key with

PDP_ACTIVE_ENV

, that PDP will only serve policy decisions for that specific environment within that project. (1) ​*Options for multiple projects in the same EKS cluster*​: 1. ​*Run separate PDP instances*​ — Each PDP deployment uses its own Environment API Key (or Project API Key +

PDP_ACTIVE_ENV

) for the specific project/environment it needs to serve. This is the recommended approach. 2. ​*Use an Organization API Key*​ — If you need one PDP to serve a specific environment across projects, you can use:

docker run -it \
  -p 7766:7000 \
  --env PDP_ORG_API_KEY=<YOUR_ORG_API_KEY> \
  --env PDP_ACTIVE_PROJECT=<YOUR_PROJECT_ID_OR_KEY> \
  --env PDP_ACTIVE_ENV=<YOUR_ENVIRONMENT_ID_OR_KEY> \
  --env PDP_DEBUG=True \
  permitio/pdp-v2:latest

But note: even with an Org API Key, you still specify ​*one*​ project and ​*one*​ environment per PDP instance. ​*Bottom line*​: For Ethan to access a different project, you'll need a separate PDP instance configured for that project's environment. * To help our engineers investigate the 403 error Ethan mentioned earlier, could you share: 1. Which ​*Workspace / Project / Environment*​ Ethan is using 2. The ​*SDK code or cURL calls*​ being performed 3. The ​*PDP version*​ you're running 4. ​*Relevant PDP logs*​

To learn more, see the sources I considered: [[1] Deploy Permit to Production](https://docs.permit.io/how-to/deploy/deploy-to-production)

I recommend you DON'T USE project keys