---
title: "Manage Access to Public Models"
description: "Manage least-privilege access to On-Demand Inference public models with scoped AI API keys."
url: https://community.exoscale.com/product/concrete-ai/on-demand-inference/how-to/manage-model-access/
product: "On-Demand Inference"
section: product
last_updated: 2026-10-22
---
> For AI agents: the documentation index is at https://community.exoscale.com/llms.txt. Every page is available as markdown at `<page URL>index.md` or with `Accept: text/markdown`.

# Manage Access to Public Models

Use scoped AI API keys to control which On-Demand Inference public models an
application can access. Create a separate key for each application or workload
so that you can change or revoke its access independently.

> [!IMPORTANT]
> **Private Preview**
>
> On-Demand Inference is currently available as a private preview. Review the
> [service boundaries](https://community.exoscale.com/product/concrete-ai/on-demand-inference/service-boundaries/index.md) before you
> begin.

## Prerequisites

You need:

* the Exoscale CLI (`exo`) [installed and configured](https://community.exoscale.com/reference/cli/exo/index.md)
* an Exoscale API key with access to the `compute` and `ai` services

## Select the Public Models

List the two private-preview public models available in AT-VIE-2 through the
shared endpoint `inference.at-vie-2.exoscale-cloud.com/v1`:

```bash
exo ai model list --visibility=public -z <zone>
```

Display details for a public model:

```bash
exo ai model show <model-id>|<model-name> -z <zone>
```

Example:

```bash
exo ai model show "nvidia/Qwen3.8-27B-NVFP4" -z at-vie-2
```

Use the model name from the output when creating the AI API key.

## Create a Scoped AI API Key

Create a key that grants access only to the chat-completions model:

```bash
exo ai api-key create akey -z at-vie-2 --model "nvidia/Qwen3.8-27B-NVFP4"
```

Grant the same key access to both private-preview models:

```bash
exo ai api-key create akey -z at-vie-2 \
  --model "nvidia/Qwen3.8-27B-NVFP4" \
  --model "Qwen/Qwen3-Embedding-8B"
```

The command returns the plaintext key once. Store it securely because it
cannot be retrieved later.

## Verify the Scope

Show the key details and confirm that the intended public models are listed:

```bash
exo ai api-key show <name>|<uuid> -z <zone>
```

A key should grant only the access its application requires. For example, an
embedding-only application does not need access to `nvidia/Qwen3.8-27B-NVFP4`.

## Update Model Access

Updating a key replaces the public models it can access.

```bash
exo ai api-key update
   <name>|<uuid> \
   --model <name> \
   -z <zone>
```

Examples:

```bash
exo ai api-key update akey -z at-vie-2 --all-models # Grant access to all public models
exo ai api-key update akey -z at-vie-2 --model "nvidia/Qwen3.8-27B-NVFP4"
exo ai api-key update akey -z at-vie-2 \
  --model "nvidia/Qwen3.8-27B-NVFP4" \
  --model "Qwen/Qwen3-Embedding-8B"
```

Show the key again after the update to verify its new scope.

## Rotate an AI API Key

To replace a key without interrupting the application:

1. Create a new key with the same model scope and a different name.
2. Store the new plaintext key when it is returned.
3. Configure the application to use the new key.
4. Send a test inference request with the new key.
5. Revoke the old key after the application is using the replacement.

Creating the replacement before revoking the existing key allows both keys to
work during the migration.

## Revoke Access

Revoke a key when an application no longer needs access or after completing a
key rotation:

```bash
exo ai api-key revoke <name>|<uuid> -z <zone>
```

The key no longer authenticates requests after revocation has propagated. It
remains visible in the key list for 30 days before being purged:

```bash
exo ai api-key list -z <zone>
```

## Diagnose Access Errors

| Response | Meaning | Action |
| :--- | :--- | :--- |
| `401 Unauthorized` | The AI API key is unknown or revoked. | Configure the application with an active key. |
| `403 Forbidden` | The key is valid, but its scope does not include the requested model. | Add the model to the key or use a correctly scoped key. |
| `429 Too Many Requests` | The organization's On-Demand Inference consumption quota is exhausted. | Review usage and quota before retrying. |

For complete command syntax, see the [On-Demand Inference CLI reference](https://community.exoscale.com/reference/cli/exo/ai/index.md).