Projects & API Tokens

Projects are the operational unit of the tenancy hierarchy, each with a dedicated Kubernetes namespace, resource quota, and API token.

Creating a Project

Go to Settings → Tenancy → Projects (or select a department and click New Project)
Enter a name and slug
Set resource quotas (CPU, memory, storage, GPU)
Click Create

A dedicated Kubernetes namespace (apps-<slug>) is created with a ResourceQuota enforcing the configured limits.

Resource Quotas

Field	Default	Description
CPU	4	Maximum CPU cores available to all workloads in the project
Memory	8Gi	Maximum memory across all pods
Storage	50Gi	Maximum total PVC storage
GPU	0	Maximum GPU units (requires GPU nodes)

Allowed MCP Servers

Each project has a whitelist of MCP servers that project members can call. Requests to MCP servers not on the whitelist are rejected when authenticated with a project token.

To manage the whitelist:

Open the project in Settings → Tenancy → Projects
Go to MCP Servers
Toggle which servers are allowed

Project API Tokens

Every project has a single API token used for programmatic access. This token:

Never expires (unlike user JWTs)
Restricts access to the project’s namespace and allowed MCP servers
Can be used with the X-API-Key header or as an Authorization: Bearer token

Viewing the Token

Open the project in Settings → Tenancy → Projects
Click Show Token

Using the Token in Notebooks

The project token is automatically injected into Jupyter notebooks as the FTN_API_KEY environment variable. Use it with the OpenAI-compatible SDK:

import os
from openai import OpenAI

client = OpenAI(
    base_url=f"{os.environ['FTN_BASE_URL']}/api/v1",
    api_key=os.environ['FTN_API_KEY']
)

response = client.chat.completions.create(
    model="llama3:8b",
    messages=[{"role": "user", "content": "Summarize this dataset"}]
)

Using the Token in External Services

curl -X POST https://<domain>/api/v1/chat/completions \
  -H "X-API-Key: <project-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "llama3:8b",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

Regenerating the Token

If a token is compromised, regenerate it from the project settings. The old token is immediately invalidated.