# Key concepts

> Organisations, projects, API keys, roles, and how a request is paid for with credits or your own provider keys.

Source: https://digitspace.ai/docs/concepts · Last checked: 2026-10-31

## Organisations and projects

An **organisation** holds billing, credits, team members and provider keys. A **project** sits inside an organisation and keeps its own API keys, usage and settings, such as the [routing strategy](/docs/routing/strategy) and how requests are paid.

Use one project per app or environment, for example _production_ and _staging_, so their spend and settings stay apart. Owners and admins create organisations and projects from the switcher at the top of the dashboard.

## API keys

An API key belongs to a project. Send it as a bearer token:

```http
Authorization: Bearer <your-key>
```

The gateway also accepts it as `x-api-key`, which is what the Anthropic SDK sends. Each key can have:

- **an expiry date**, after which it returns `401`;
- **a total limit** in dollars, which never resets;
- **a repeating limit** that resets every so many hours, days, weeks or months;
- **access rules** that allow or block models, providers, price ranges and IP addresses.

The secret is shown once when the key is created. DigitSpace keeps only a hash of it. [API keys in the dashboard](/docs/dashboard/api-keys) covers the details.

## Credits or your own keys

Each project chooses how its requests are paid, under **Settings → Preferences → How requests are paid**:

| Setting                    | What happens                                                                                       |
| -------------------------- | -------------------------------------------------------------------------------------------------- |
| **Credits**                | Every request uses DigitSpace's provider accounts and is paid from your credit balance.               |
| **Own keys**               | Every request uses the provider keys you added. Nothing is taken from credits.                     |
| **Own keys, then credits** | A provider you have a key for uses your key; any other provider uses credits. This is the default. |

The choice is made per provider while the route is built, so with **Own keys, then credits** one request can try a provider on your key and fail over to another on credits.

Credits pay each provider's listed price for the tokens used, plus a 5% fee on each top-up. Requests on your own keys are free on DigitSpace's side; the provider bills you. Their cost is still estimated at catalogue prices and counts toward your keys' spending limits. See [Billing](/docs/dashboard/billing) for top-ups, refunds and invoices.

## Roles

| Role              | Can                                                                                         |
| ----------------- | ------------------------------------------------------------------------------------------- |
| **Owner**         | Everything, including adding or removing owners and deleting projects.                      |
| **Admin**         | Billing, team, provider keys, guardrails, routing and settings for every project.           |
| **Project admin** | Manage the projects they're assigned to, including every key in them.                       |
| **Developer**     | Use the projects they're assigned to, with their own keys, inside the budget an admin sets. |

Assigning project admins and developers to specific projects is part of the Enterprise plan. [Team and roles](/docs/dashboard/team) explains invitations and budgets.

## Models, providers and offers

A **model** is what you ask for, such as `gpt-6-luna`. A **provider** is a company that serves it, such as OpenAI or Azure. One model can have several **offers**, one per provider, each with its own price, speed and limits. Routing picks the offer; [How routing works](/docs/routing/strategy) explains how.