diff --git a/meilisearch-auth/src/action.rs b/meilisearch-auth/src/action.rs
index 7ffe9b908..088ad6ba7 100644
--- a/meilisearch-auth/src/action.rs
+++ b/meilisearch-auth/src/action.rs
@@ -5,7 +5,7 @@ use serde::{Deserialize, Serialize};
 #[repr(u8)]
 pub enum Action {
     #[serde(rename = "*")]
-    All = 0,
+    All = actions::ALL,
     #[serde(rename = "search")]
     Search = actions::SEARCH,
     #[serde(rename = "documents.add")]
@@ -36,13 +36,21 @@ pub enum Action {
     DumpsGet = actions::DUMPS_GET,
     #[serde(rename = "version")]
     Version = actions::VERSION,
+    #[serde(rename = "keys.create")]
+    KeysAdd = actions::KEYS_CREATE,
+    #[serde(rename = "keys.get")]
+    KeysGet = actions::KEYS_GET,
+    #[serde(rename = "keys.update")]
+    KeysUpdate = actions::KEYS_UPDATE,
+    #[serde(rename = "keys.delete")]
+    KeysDelete = actions::KEYS_DELETE,
 }
 
 impl Action {
     pub fn from_repr(repr: u8) -> Option<Self> {
         use actions::*;
         match repr {
-            0 => Some(Self::All),
+            ALL => Some(Self::All),
             SEARCH => Some(Self::Search),
             DOCUMENTS_ADD => Some(Self::DocumentsAdd),
             DOCUMENTS_GET => Some(Self::DocumentsGet),
@@ -58,6 +66,10 @@ impl Action {
             DUMPS_CREATE => Some(Self::DumpsCreate),
             DUMPS_GET => Some(Self::DumpsGet),
             VERSION => Some(Self::Version),
+            KEYS_CREATE => Some(Self::KeysAdd),
+            KEYS_GET => Some(Self::KeysGet),
+            KEYS_UPDATE => Some(Self::KeysUpdate),
+            KEYS_DELETE => Some(Self::KeysDelete),
             _otherwise => None,
         }
     }
@@ -65,7 +77,7 @@ impl Action {
     pub fn repr(&self) -> u8 {
         use actions::*;
         match self {
-            Self::All => 0,
+            Self::All => ALL,
             Self::Search => SEARCH,
             Self::DocumentsAdd => DOCUMENTS_ADD,
             Self::DocumentsGet => DOCUMENTS_GET,
@@ -81,11 +93,16 @@ impl Action {
             Self::DumpsCreate => DUMPS_CREATE,
             Self::DumpsGet => DUMPS_GET,
             Self::Version => VERSION,
+            Self::KeysAdd => KEYS_CREATE,
+            Self::KeysGet => KEYS_GET,
+            Self::KeysUpdate => KEYS_UPDATE,
+            Self::KeysDelete => KEYS_DELETE,
         }
     }
 }
 
 pub mod actions {
+    pub(crate) const ALL: u8 = 0;
     pub const SEARCH: u8 = 1;
     pub const DOCUMENTS_ADD: u8 = 2;
     pub const DOCUMENTS_GET: u8 = 3;
@@ -101,4 +118,8 @@ pub mod actions {
     pub const DUMPS_CREATE: u8 = 13;
     pub const DUMPS_GET: u8 = 14;
     pub const VERSION: u8 = 15;
+    pub const KEYS_CREATE: u8 = 16;
+    pub const KEYS_GET: u8 = 17;
+    pub const KEYS_UPDATE: u8 = 18;
+    pub const KEYS_DELETE: u8 = 19;
 }
diff --git a/meilisearch-http/src/routes/api_key.rs b/meilisearch-http/src/routes/api_key.rs
index ba964e5d1..37ff80ec6 100644
--- a/meilisearch-http/src/routes/api_key.rs
+++ b/meilisearch-http/src/routes/api_key.rs
@@ -29,7 +29,7 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
 }
 
 pub async fn create_api_key(
-    auth_controller: GuardedData<MasterPolicy, AuthController>,
+    auth_controller: GuardedData<ActionPolicy<{ actions::KEYS_CREATE }>, AuthController>,
     body: web::Json<Value>,
     _req: HttpRequest,
 ) -> Result<HttpResponse, ResponseError> {
@@ -45,7 +45,7 @@ pub async fn create_api_key(
 }
 
 pub async fn list_api_keys(
-    auth_controller: GuardedData<MasterPolicy, AuthController>,
+    auth_controller: GuardedData<ActionPolicy<{ actions::KEYS_GET }>, AuthController>,
     _req: HttpRequest,
 ) -> Result<HttpResponse, ResponseError> {
     let res = tokio::task::spawn_blocking(move || -> Result<_, AuthControllerError> {
@@ -63,7 +63,7 @@ pub async fn list_api_keys(
 }
 
 pub async fn get_api_key(
-    auth_controller: GuardedData<MasterPolicy, AuthController>,
+    auth_controller: GuardedData<ActionPolicy<{ actions::KEYS_GET }>, AuthController>,
     path: web::Path<AuthParam>,
 ) -> Result<HttpResponse, ResponseError> {
     let key = path.into_inner().key;
@@ -81,7 +81,7 @@ pub async fn get_api_key(
 }
 
 pub async fn patch_api_key(
-    auth_controller: GuardedData<MasterPolicy, AuthController>,
+    auth_controller: GuardedData<ActionPolicy<{ actions::KEYS_UPDATE }>, AuthController>,
     body: web::Json<Value>,
     path: web::Path<AuthParam>,
 ) -> Result<HttpResponse, ResponseError> {
@@ -100,7 +100,7 @@ pub async fn patch_api_key(
 }
 
 pub async fn delete_api_key(
-    auth_controller: GuardedData<MasterPolicy, AuthController>,
+    auth_controller: GuardedData<ActionPolicy<{ actions::KEYS_DELETE }>, AuthController>,
     path: web::Path<AuthParam>,
 ) -> Result<HttpResponse, ResponseError> {
     let key = path.into_inner().key;