Free guide · Oct 13, 2026
Dify: limit an API key to one knowledge base
How to make the narrow key, a request that works and two that shouldn't, and what to check about old keys before the upgrade.
The short version
Dify is an open source platform for building AI apps and agents on top of your own documents. Before version 1.17.1, one knowledge base API key could read and write every knowledge base in your workspace. Now you can limit a new key to the knowledge bases you pick when you create it.
A scoped key returns 403 Forbidden for any other knowledge base, for both documents and retrieval, and for calls with no knowledge base ID at all, such as listing every dataset. This guide shows how to make the narrow key, a request that should work and two that should not, and what to check about old keys and the upgrade. I read the official release notes, docs and license for this; I have not run these steps myself.
What's in the full guide
- 01What you need
- 02Step 1: Make the narrow key
- 03Step 2: Try a request that works
- 04Step 3: Try two that should not work
- 05Step 4: Check old keys before the upgrade
- 06How I would judge the result
- 07The catch
- 08Sources