Manage Access to Public Models

Use scoped AI API keys to control which On-Demand Inference public models an application can access. Create a separate key for each application or workload so that you can change or revoke its access independently.

Prerequisites

You need:

• the Exoscale CLI (exo) installed and configured
• an Exoscale API key with access to the compute and ai services

Select the Public Models

List the two private-preview public models available in AT-VIE-2 through the shared endpoint inference.at-vie-2.exoscale-cloud.com/v1:

exo ai model list --visibility=public -z <zone>

Display details for a public model:

exo ai model show <model-id>|<model-name> -z <zone>

Example:

exo ai model show "nvidia/Qwen3.8-27B-NVFP4" -z at-vie-2

Use the model name from the output when creating the AI API key.

Create a Scoped AI API Key

Create a key that grants access only to the chat-completions model:

exo ai api-key create akey -z at-vie-2 --model "nvidia/Qwen3.8-27B-NVFP4"

Grant the same key access to both private-preview models:

exo ai api-key create akey -z at-vie-2 \
  --model "nvidia/Qwen3.8-27B-NVFP4" \
  --model "Qwen/Qwen3-Embedding-8B"

The command returns the plaintext key once. Store it securely because it cannot be retrieved later.

Verify the Scope

Show the key details and confirm that the intended public models are listed:

exo ai api-key show <name>|<uuid> -z <zone>

A key should grant only the access its application requires. For example, an embedding-only application does not need access to nvidia/Qwen3.8-27B-NVFP4.

Update Model Access

Updating a key replaces the public models it can access.

exo ai api-key update
   <name>|<uuid> \
   --model <name> \
   -z <zone>

Examples:

exo ai api-key update akey -z at-vie-2 --all-models # Grant access to all public models
exo ai api-key update akey -z at-vie-2 --model "nvidia/Qwen3.8-27B-NVFP4"
exo ai api-key update akey -z at-vie-2 \
  --model "nvidia/Qwen3.8-27B-NVFP4" \
  --model "Qwen/Qwen3-Embedding-8B"

Show the key again after the update to verify its new scope.

Rotate an AI API Key

To replace a key without interrupting the application:

1. Create a new key with the same model scope and a different name.
2. Store the new plaintext key when it is returned.
3. Configure the application to use the new key.
4. Send a test inference request with the new key.
5. Revoke the old key after the application is using the replacement.

Creating the replacement before revoking the existing key allows both keys to work during the migration.

Revoke Access

Revoke a key when an application no longer needs access or after completing a key rotation:

exo ai api-key revoke <name>|<uuid> -z <zone>

The key no longer authenticates requests after revocation has propagated. It remains visible in the key list for 30 days before being purged:

exo ai api-key list -z <zone>

Diagnose Access Errors

For complete command syntax, see the On-Demand Inference CLI reference.