> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Set the default API key lifetime policy > Set the org-wide limit for self-serve API keys. `max_lifetime_days` (1-3650) caps how long a key may live from when it is created or rotated, and also rules out keys that never expire; `require_expiry` requires an expiry without capping it; `fixed_lifetime` gives every key exactly `max_lifetime_days`, so users don't choose one. Sending none removes the default. ## OpenAPI ````yaml /api-reference/openapi.yaml put /api/llm-gateway/admin/api-key-lifetime-policies/default openapi: 3.1.0 info: title: Barndoor.ai Public API description: Unified public API specification for Barndoor.ai platform version: 2.18.0 servers: - url: https://{host} description: Barndoor public API variables: host: default: platform.barndoor.ai description: >- The host serving your Barndoor deployment. Defaults to production; override it for another environment or a dedicated deployment. security: - ApiKey: [] - OAuth2: - openid - profile - email tags: - name: dlp x-group: Data Control Center - name: identity x-group: Identity - name: llm-gateway x-group: LLM Gateway - name: notification x-group: Notifications - name: policy x-group: Policies - name: registry x-group: MCP Gateway - name: system-management x-group: Log Exports paths: /api/llm-gateway/admin/api-key-lifetime-policies/default: put: tags: - llm-gateway summary: Set the default API key lifetime policy description: >- Set the org-wide limit for self-serve API keys. `max_lifetime_days` (1-3650) caps how long a key may live from when it is created or rotated, and also rules out keys that never expire; `require_expiry` requires an expiry without capping it; `fixed_lifetime` gives every key exactly `max_lifetime_days`, so users don't choose one. Sending none removes the default. operationId: set_default_lifetime_policy requestBody: content: application/json: schema: $ref: '#/components/schemas/LifetimeLimitInput' required: true responses: '200': description: The updated policies content: application/json: schema: $ref: '#/components/schemas/ApiKeyLifetimePolicies' '400': description: Malformed request '401': description: Missing or invalid credentials '403': description: Caller is not permitted to act on this resource in this organization components: schemas: LifetimeLimitInput: type: object description: >- The settings an admin writes, for the org default, one group or one user. properties: fixed_lifetime: type: boolean description: |- Give every key exactly `max_lifetime_days` instead of capping at it. Omitted = false, so every existing caller keeps writing a cap. max_lifetime_days: type: - integer - 'null' format: int32 require_expiry: type: boolean ApiKeyLifetimePolicies: type: object required: - groups - users properties: default: oneOf: - $ref: '#/components/schemas/ApiKeyLifetimePolicy' description: >- The org default; `None` means self-serve keys have no lifetime limit unless a group override applies. - type: 'null' groups: type: array items: $ref: '#/components/schemas/ApiKeyLifetimePolicy' description: >- Per-IdP-group overrides. A user in several of these gets the strictest. users: type: array items: $ref: '#/components/schemas/ApiKeyLifetimeUserOverride' description: >- Per-user overrides. A user's own override wins over their groups and the default. ApiKeyLifetimePolicy: type: object description: >- One stored row: the org default (`group_name: None`) or a group override. required: - id - require_expiry - fixed_lifetime - updated_at properties: fixed_lifetime: type: boolean description: >- Every key gets exactly `max_lifetime_days` and the user doesn't choose (BCP-5229). Requires `max_lifetime_days`. group_name: type: - string - 'null' description: >- `None` for the org default; otherwise the IdP group this overrides it for. id: type: string format: uuid max_lifetime_days: type: - integer - 'null' format: int32 description: |- Longest a key may live, in days from when it is created or rotated. `None` = no maximum. A maximum also rules out a never-expiring key. require_expiry: type: boolean description: The key must have an expiry, even when there is no maximum. updated_at: type: string format: date-time updated_by_user_id: type: - string - 'null' format: uuid ApiKeyLifetimeUserOverride: type: object description: >- A per-user override (BCP-5283). It wins outright: the user's group overrides and the org default don't apply to them. required: - id - user_id - require_expiry - fixed_lifetime - updated_at properties: fixed_lifetime: type: boolean description: >- Every key gets exactly `max_lifetime_days`. Requires `max_lifetime_days`. id: type: string format: uuid max_lifetime_days: type: - integer - 'null' format: int32 description: Longest a key may live, in days. `None` = no maximum. require_expiry: type: boolean description: The key must have an expiry, even when there is no maximum. updated_at: type: string format: date-time updated_by_user_id: type: - string - 'null' format: uuid user_id: type: string format: uuid description: The user this override applies to. securitySchemes: ApiKey: type: http scheme: bearer description: >- A Barndoor API key, sent as `Authorization: Bearer `. Keys are prefixed `bdai_` and are opaque — do not attempt to decode one. Interchangeable with an OAuth 2.0 access token. OAuth2: type: oauth2 x-issuer: https://auth.barndoor.ai/realms/barndoor description: >- An OAuth 2.0 access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Public clients must use PKCE. Interchangeable with an API key. flows: authorizationCode: authorizationUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/auth tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. clientCredentials: tokenUrl: >- https://auth.barndoor.ai/realms/barndoor/protocol/openid-connect/token scopes: openid: Issue an OIDC ID token identifying the caller. profile: Read the caller's basic profile claims. email: Read the caller's email address. offline_access: Issue a refresh token. Optional — no operation requires it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.