HUD Documentation - Evaluations and RL Environments.

Your active team is the isolation boundary for platform resources, credentials, usage, and billing. API requests are authorized as one membership within that team, even though the corresponding platform routes use /project.

Roles and access

Role	Typical access
Team admin	Manage members, billing, team credentials, shared data, and team-wide limits.
Team member	Work with team resources and manage personal credentials and files.
External collaborator	Access explicitly shared resources and personal files.

Sharing an environment, taskset, job, or trace grants access to that resource. It does not move the resource to another team or expose unrelated credentials and data.

API keys

A HUD_API_KEY authenticates the CLI, SDK, REST API, Platform MCP, and inference gateway. Each key belongs to a membership and its active team, so usage and limits can be attributed to the person or automation that used it. Open API Keys to:

create a named key with an optional expiration
copy its value when it is created
rename or revoke a key
inspect month-to-date inference spend
attach a weekly or monthly spend limit

The full key value is shown once. Revoking it stops new authenticated requests immediately. Team admins can also create keys for another member and inspect team key ownership.

Choose the right secret scope

Credential store	Scope	Use it for
Environment variables	One environment, shared with its editors	Credentials and configuration required by that environment.
Personal secrets	One membership, injected into every rollout sandbox it launches	Values the member’s sandbox workloads may access.
BYOK credentials	Personal or team provider route	Provider API keys used by eligible inference requests.

Do not put a provider key in personal secrets when the inference gateway should own and meter the provider call. Use BYOK for that path. Use an environment variable when the task itself must call an external service.

Usage and billing

Usage separates inference spend from environment runtime and lets admins inspect team-wide attribution. A job also has its own Usage tab for the cost of that evaluation. Billing is admin-only. It manages the subscription, credit balance, payment methods, and automatic top-ups. Platform and model availability can depend on the team’s plan and enabled features.

Spend limits

Limits can apply to the whole team, one membership across all of its keys, or one API key.

Action	Behavior
Alert	Email the configured recipients after spend crosses the amount.
Block	Refuse new inference requests and environment sessions after the amount is reached.

Each limit uses a UTC calendar week or month. When several blocking limits apply, the tightest one wins. Existing runs are not retroactively changed, and no limit is enabled by default. API authentication formats are under REST API and Platform MCP.

Start here

Core workflows

Platform features

Reference

Team settings

Roles and access

API keys

Choose the right secret scope

Usage and billing

Spend limits

​Roles and access

​API keys

​Choose the right secret scope

​Usage and billing

​Spend limits

Roles and access

API keys

Choose the right secret scope

Usage and billing

Spend limits