Why aren't the API keys for Dify datasets isolated by dataset?

[ruanimal]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
• Please do not modify this template :) and fill in all the required fields.

Content

Was this deliberately designed this way?

[dosubot[bot]]

This was a deliberate design decision. Dify manages dataset API keys at the workspace (tenant) level, not isolated per dataset, to centralize credential management and simplify administration. This approach makes it easier to handle permissions, rotate keys, and maintain security across multiple datasets and apps in a workspace. Previously, keys could be managed per dataset, but starting from v1.9.0, the system shifted to tenant-level API key management via API endpoints, and the UI no longer exposes per-dataset key creation or management. Existing dataset-specific keys still work, but new keys must be managed through the workspace API system reference, reference.

If you need strict separation (like per-client or per-agent keys), the recommended workaround is to run separate Dify instances or workspaces, since per-tool credential assignment is supported but not per-dataset reference. There are plans for more granular permission systems in future enterprise editions, but for now, dataset API keys are managed centrally for simplicity and security.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[ruanimal]

#31409