From c43cc8e1fab547d3ffde3258bd002b97c2a04cd6 Mon Sep 17 00:00:00 2001 From: Matt Linville Date: Tue, 13 Jan 2026 15:37:20 -0800 Subject: [PATCH 1/3] Hashed API key updates for single-tenant - Tiny updates to audit logging for service account API keys - Updates to Service Account page for single-tenant - Adjusted steps for creating and finding API keys Based on this Notion: https://www.notion.so/wandbai/Hashed-view-once-API-Keys-content-for-user-facing-docs-2bee2f5c7ef380619fd4e99cc971136d?source=copy_link --- platform/hosting/iam/service-accounts.mdx | 2 +- .../monitoring-usage/audit-logging.mdx | 4 +-- snippets/en/_includes/api-key-create.mdx | 15 ++++++----- snippets/en/_includes/api-key-find.mdx | 26 +++++++++++-------- .../_includes/org-service-account-create.mdx | 7 ++++- 5 files changed, 33 insertions(+), 21 deletions(-) diff --git a/platform/hosting/iam/service-accounts.mdx b/platform/hosting/iam/service-accounts.mdx index 5db85a6835..7871cbd813 100644 --- a/platform/hosting/iam/service-accounts.mdx +++ b/platform/hosting/iam/service-accounts.mdx @@ -35,7 +35,7 @@ Service accounts are particularly useful for: - **Airflow/Prefect/Dagster**: ML pipeline orchestration tools -Service accounts are available on [Dedicated Cloud](/platform/hosting/hosting-options/dedicated_cloud), [Self-Managed instances](/platform/hosting/hosting-options/self-managed) with an enterprise license, and enterprise accounts in [SaaS Cloud](/platform/hosting/hosting-options/multi_tenant_cloud). +Service accounts are available on [Dedicated Cloud](/platform/hosting/hosting-options/dedicated_cloud), [Self-Managed instances](/platform/hosting/hosting-options/self-managed) with an enterprise license, and enterprise accounts in [Multi-tenant Cloud](/platform/hosting/hosting-options/multi_tenant_cloud). ## Organization-scoped service accounts diff --git a/platform/hosting/monitoring-usage/audit-logging.mdx b/platform/hosting/monitoring-usage/audit-logging.mdx index 5376aac207..62c731f338 100644 --- a/platform/hosting/monitoring-usage/audit-logging.mdx +++ b/platform/hosting/monitoring-usage/audit-logging.mdx @@ -121,10 +121,10 @@ This table describes possible actions that can be recorded by W&B, sorted alphab | `team:delete` | Team is deleted. | `team:invite_user` | User is invited to team. | `team:uninvite` | User or service account is uninvited from team. -| `user:create_api_key` | API key for the user is created. 1 +| `user:create_api_key` | API key for the user or service account is created. 1 | `user:create` | User is created. 1 | `user:deactivate` | User is deactivated. 1 -| `user:delete_api_key` | API key for the user is deleted. 1 +| `user:delete_api_key` | API key for the user or service account is deleted. 1 | `user:initiate_login` | User initiates log in. 1 | `user:login` | User logs in. 1 | `user:logout` | User logs out. 1 diff --git a/snippets/en/_includes/api-key-create.mdx b/snippets/en/_includes/api-key-create.mdx index fb14de92e7..c71aea3d05 100644 --- a/snippets/en/_includes/api-key-create.mdx +++ b/snippets/en/_includes/api-key-create.mdx @@ -4,20 +4,23 @@ import ServiceAccountApiKeyCreate from "/snippets/en/_includes/service-account-a To create an API key, select the **Personal API key** or **Service Account API key** tab for details. - + To create a personal API key owned by your user ID: -1. Navigate to [User Settings](https://wandb.ai/settings) and log in if necessary. +1. Log in to W&B, click your user profile icon, then click **User Settings**. 2. Click **Create new API key**. 3. Provide a descriptive name for your API key. 4. Click **Create**. 5. Copy the displayed API key immediately and store it securely. - - - - + + + + + + + For secure storage options, see [Store API keys securely](#store-and-handle-api-keys-securely). diff --git a/snippets/en/_includes/api-key-find.mdx b/snippets/en/_includes/api-key-find.mdx index 9b9dcf1c2c..9b1183e791 100644 --- a/snippets/en/_includes/api-key-find.mdx +++ b/snippets/en/_includes/api-key-find.mdx @@ -1,23 +1,27 @@ + +In **Dedicated Cloud** and **Self-Managed**: +- Organization admins can find or list API keys for all organization users and service accounts. +- Team admins can find or list API keys for service accounts in teams they administer. +- Non-admin users can find or list their own API keys. + + To find an API key, select the **Personal API key** or **Service Account API key** tab for details. - + To find a personal API key owned by your user ID: -1. Navigate to [User Settings](https://wandb.ai/settings) and log in if necessary. -2. Alternatively, access your user settings: - - Click your user profile icon in the upper-right corner. - - Select **User Settings**. - - Scroll to the **API Keys** section. - - +1. Log in to W&B, click your user profile icon, then click **User Settings**. +2. Scroll to the **API Keys** section. + + + To find an API key owned by an organization or team service account: 1. Navigate to the **API Keys** tab in your organization settings. 2. Find the API key in the list. You can search or filter the list by owner, key name, or key ID. - + + - The API keys table shows the key ID (the first part of each API key) for identification purposes. The full secret API key is only displayed once when you create it. If you need to use an existing key but do not have the full secret stored, you must create a new API key. - diff --git a/snippets/en/_includes/org-service-account-create.mdx b/snippets/en/_includes/org-service-account-create.mdx index c2f1e684aa..af86067abb 100644 --- a/snippets/en/_includes/org-service-account-create.mdx +++ b/snippets/en/_includes/org-service-account-create.mdx @@ -1,6 +1,11 @@ + +Organization-scoped service accounts are not available in Multi-tenant Cloud. + + To create a new organization-scoped service account and API key: -1. Go to [Organization settings](https://wandb.ai/account-settings/), then click **Service Accounts**. +1. Log in to W&B, click your user profile icon, then click **Organization Dashboard**. +1. Select the **Service Accounts** tab. 2. Click **Create service account**. 3. Provide a name and select a default team. 4. Click **Create**. From 22c85000f22e4a5025d79c593791a2e492b88fb9 Mon Sep 17 00:00:00 2001 From: Matt Linville Date: Tue, 13 Jan 2026 15:58:18 -0800 Subject: [PATCH 2/3] Jenn's feedback --- snippets/en/_includes/org-service-account-create.mdx | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/snippets/en/_includes/org-service-account-create.mdx b/snippets/en/_includes/org-service-account-create.mdx index af86067abb..ee6210b2c7 100644 --- a/snippets/en/_includes/org-service-account-create.mdx +++ b/snippets/en/_includes/org-service-account-create.mdx @@ -4,7 +4,9 @@ Organization-scoped service accounts are not available in Multi-tenant Cloud. To create a new organization-scoped service account and API key: -1. Log in to W&B, click your user profile icon, then click **Organization Dashboard**. +1. Log in to W&B, click your user profile icon, then: + - **Dedicated Cloud** or **Self-Managed**: Click **Organization Dashboard**, then click **Service Accounts**. + - **Multi-tenant Cloud**: Click **Service Accounts**. 1. Select the **Service Accounts** tab. 2. Click **Create service account**. 3. Provide a name and select a default team. From d0481360da6176b42cb20c8d9aff4075ec9ff394 Mon Sep 17 00:00:00 2001 From: Matt Linville Date: Tue, 13 Jan 2026 16:04:51 -0800 Subject: [PATCH 3/3] More Jenn's feedback --- snippets/en/_includes/org-service-account-create.mdx | 5 ----- 1 file changed, 5 deletions(-) diff --git a/snippets/en/_includes/org-service-account-create.mdx b/snippets/en/_includes/org-service-account-create.mdx index ee6210b2c7..046e502e3d 100644 --- a/snippets/en/_includes/org-service-account-create.mdx +++ b/snippets/en/_includes/org-service-account-create.mdx @@ -1,13 +1,8 @@ - -Organization-scoped service accounts are not available in Multi-tenant Cloud. - - To create a new organization-scoped service account and API key: 1. Log in to W&B, click your user profile icon, then: - **Dedicated Cloud** or **Self-Managed**: Click **Organization Dashboard**, then click **Service Accounts**. - **Multi-tenant Cloud**: Click **Service Accounts**. -1. Select the **Service Accounts** tab. 2. Click **Create service account**. 3. Provide a name and select a default team. 4. Click **Create**.