diff --git a/src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs b/src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs
index ef07c9d..7395776 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Alarms/GatewayAlarmMonitor.cs
@@ -203,6 +203,7 @@ public sealed class GatewayAlarmMonitor : BackgroundService, IGatewayAlarmServic
         GatewaySession session = await _sessionManager.OpenSessionAsync(
                 new SessionOpenRequest(BackendName, MonitorClientName, Guid.NewGuid().ToString("N"), CommandTimeout: null),
                 MonitorClientName,
+                ownerKeyId: null,
                 stoppingToken)
             .ConfigureAwait(false);
         lock (_sync) { _session = session; }
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs
index 9e7b4b2..41f1d09 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardLiveDataService.cs
@@ -138,6 +138,7 @@ public sealed class DashboardLiveDataService : IDashboardLiveDataService, IAsync
         GatewaySession session = await _sessionManager.OpenSessionAsync(
                 new SessionOpenRequest(BackendName, ClientName, Guid.NewGuid().ToString("N"), CommandTimeout: null),
                 ClientName,
+                ownerKeyId: null,
                 cancellationToken)
             .ConfigureAwait(false);
 
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGatewayService.cs b/src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGatewayService.cs
index 90a0e54..a365260 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGatewayService.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Grpc/MxAccessGatewayService.cs
@@ -36,6 +36,7 @@ public sealed class MxAccessGatewayService(
                 .OpenSessionAsync(
                     SessionOpenRequest.FromContract(request),
                     ResolveClientIdentity(),
+                    identityAccessor.Current?.KeyId,
                     context.CancellationToken)
                 .ConfigureAwait(false);
 
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs b/src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs
index eebfb4e..4a14a91 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs
@@ -48,6 +48,7 @@ public sealed class GatewaySession
             pipeName,
             nonce,
             clientIdentity,
+            ownerKeyId: null,
             clientSessionName,
             clientCorrelationId,
             commandTimeout,
@@ -66,6 +67,7 @@ public sealed class GatewaySession
     /// <param name="pipeName">Name of the named pipe for gateway-worker IPC.</param>
     /// <param name="nonce">Security nonce for worker validation.</param>
     /// <param name="clientIdentity">Client identity from the authentication context.</param>
+    /// <param name="ownerKeyId">API key identifier of the caller that created this session.</param>
     /// <param name="clientSessionName">Client-supplied session name.</param>
     /// <param name="clientCorrelationId">Client-supplied correlation identifier.</param>
     /// <param name="commandTimeout">Timeout for command invocation.</param>
@@ -79,6 +81,7 @@ public sealed class GatewaySession
         string pipeName,
         string nonce,
         string? clientIdentity,
+        string? ownerKeyId,
         string? clientSessionName,
         string? clientCorrelationId,
         TimeSpan commandTimeout,
@@ -112,6 +115,7 @@ public sealed class GatewaySession
         PipeName = pipeName;
         Nonce = nonce;
         ClientIdentity = clientIdentity;
+        OwnerKeyId = ownerKeyId;
         ClientSessionName = clientSessionName;
         ClientCorrelationId = clientCorrelationId;
         CommandTimeout = commandTimeout;
@@ -148,6 +152,11 @@ public sealed class GatewaySession
     /// </summary>
     public string? ClientIdentity { get; }
 
+    /// <summary>
+    /// Gets the API key identifier of the caller that created this session.
+    /// </summary>
+    public string? OwnerKeyId { get; }
+
     /// <summary>
     /// Gets the client-supplied session name.
     /// </summary>
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Sessions/ISessionManager.cs b/src/ZB.MOM.WW.MxGateway.Server/Sessions/ISessionManager.cs
index 2d84f26..3b146fd 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Sessions/ISessionManager.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Sessions/ISessionManager.cs
@@ -8,11 +8,13 @@ public interface ISessionManager
     /// <summary>Opens a new gateway session and launches a worker process.</summary>
     /// <param name="request">Request payload.</param>
     /// <param name="clientIdentity">Client identity string.</param>
+    /// <param name="ownerKeyId">API key identifier of the caller creating the session.</param>
     /// <param name="cancellationToken">Token to cancel the asynchronous operation.</param>
     /// <returns>The newly opened session.</returns>
     Task<GatewaySession> OpenSessionAsync(
         SessionOpenRequest request,
         string? clientIdentity,
+        string? ownerKeyId,
         CancellationToken cancellationToken);
 
     /// <summary>Attempts to retrieve a session by ID.</summary>
diff --git a/src/ZB.MOM.WW.MxGateway.Server/Sessions/SessionManager.cs b/src/ZB.MOM.WW.MxGateway.Server/Sessions/SessionManager.cs
index e7a07bf..14b4f33 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Sessions/SessionManager.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Sessions/SessionManager.cs
@@ -58,11 +58,13 @@ public sealed class SessionManager : ISessionManager
     /// </summary>
     /// <param name="request">Session open request.</param>
     /// <param name="clientIdentity">Client authentication identity.</param>
+    /// <param name="ownerKeyId">API key identifier of the caller creating the session.</param>
     /// <param name="cancellationToken">Cancellation token.</param>
     /// <returns>Opened gateway session.</returns>
     public async Task<GatewaySession> OpenSessionAsync(
         SessionOpenRequest request,
         string? clientIdentity,
+        string? ownerKeyId,
         CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(request);
@@ -72,7 +74,7 @@ public sealed class SessionManager : ISessionManager
         bool sessionOpenedRecorded = false;
         try
         {
-            session = CreateSession(request, clientIdentity);
+            session = CreateSession(request, clientIdentity, ownerKeyId);
             if (!_registry.TryAdd(session))
             {
                 throw new SessionManagerException(
@@ -420,7 +422,8 @@ public sealed class SessionManager : ISessionManager
 
     private GatewaySession CreateSession(
         SessionOpenRequest request,
-        string? clientIdentity)
+        string? clientIdentity,
+        string? ownerKeyId)
     {
         string sessionId = CreateSessionId();
         string backendName = string.IsNullOrWhiteSpace(request.RequestedBackend)
@@ -441,6 +444,7 @@ public sealed class SessionManager : ISessionManager
             pipeName,
             nonce,
             clientIdentity,
+            ownerKeyId,
             request.ClientSessionName,
             clientCorrelationId,
             commandTimeout,
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmFailoverEndToEndTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmFailoverEndToEndTests.cs
index 1a1000f..79b0797 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmFailoverEndToEndTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Alarms/AlarmFailoverEndToEndTests.cs
@@ -410,6 +410,7 @@ public sealed class AlarmFailoverEndToEndTests
         public Task<GatewaySession> OpenSessionAsync(
             SessionOpenRequest request,
             string? clientIdentity,
+            string? ownerKeyId,
             CancellationToken cancellationToken)
         {
             GatewaySession session = new(
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Alarms/GatewayAlarmMonitorProviderModeTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Alarms/GatewayAlarmMonitorProviderModeTests.cs
index 4fce26f..3fcdaa9 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Alarms/GatewayAlarmMonitorProviderModeTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Alarms/GatewayAlarmMonitorProviderModeTests.cs
@@ -711,6 +711,7 @@ public sealed class GatewayAlarmMonitorProviderModeTests
         public Task<GatewaySession> OpenSessionAsync(
             SessionOpenRequest request,
             string? clientIdentity,
+            string? ownerKeyId,
             CancellationToken cancellationToken)
         {
             GatewaySession session = new(
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAdminServiceTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAdminServiceTests.cs
index 5ffa1d0..216874c 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAdminServiceTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSessionAdminServiceTests.cs
@@ -244,6 +244,7 @@ public sealed class DashboardSessionAdminServiceTests
         public Task<GatewaySession> OpenSessionAsync(
             SessionOpenRequest request,
             string? clientIdentity,
+            string? ownerKeyId,
             CancellationToken cancellationToken)
         {
             throw new NotSupportedException();
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/EventStreamServiceTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/EventStreamServiceTests.cs
index 6f45a15..a96bd85 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/EventStreamServiceTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/EventStreamServiceTests.cs
@@ -471,6 +471,7 @@ public sealed class EventStreamServiceTests
         public Task<GatewaySession> OpenSessionAsync(
             SessionOpenRequest request,
             string? clientIdentity,
+            string? ownerKeyId,
             CancellationToken cancellationToken)
         {
             return Task.FromResult(_sessions.Values.First());
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceConstraintTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceConstraintTests.cs
index 9d226f7..0ebdc72 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceConstraintTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceConstraintTests.cs
@@ -884,10 +884,12 @@ public sealed class MxAccessGatewayServiceConstraintTests
         /// <summary>Opens a test session asynchronously.</summary>
         /// <param name="request">The session open request.</param>
         /// <param name="clientIdentity">The client identity, if any.</param>
+        /// <param name="ownerKeyId">The API key identifier of the caller, if any.</param>
         /// <param name="cancellationToken">Token to observe for cancellation.</param>
         public Task<GatewaySession> OpenSessionAsync(
             SessionOpenRequest request,
             string? clientIdentity,
+            string? ownerKeyId,
             CancellationToken cancellationToken) =>
             Task.FromResult(seededSessions.Values.First());
 
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceTests.cs
index cacda2e..26b8aa4 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Grpc/MxAccessGatewayServiceTests.cs
@@ -545,6 +545,7 @@ public sealed class MxAccessGatewayServiceTests
         public Task<GatewaySession> OpenSessionAsync(
             SessionOpenRequest request,
             string? clientIdentity,
+            string? ownerKeyId,
             CancellationToken cancellationToken)
         {
             LastOpenRequest = request;
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/GatewaySessionTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/GatewaySessionTests.cs
index 403e532..bae60d3 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/GatewaySessionTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/GatewaySessionTests.cs
@@ -164,6 +164,7 @@ public sealed class GatewaySessionTests
             pipeName: "mxaccess-gateway-1-session-test",
             nonce: "nonce",
             clientIdentity: "client-1",
+            ownerKeyId: null,
             clientSessionName: "test-session",
             clientCorrelationId: "client-correlation-1",
             commandTimeout: TimeSpan.FromSeconds(5),
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerBulkTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerBulkTests.cs
index d5fd7d4..7847550 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerBulkTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerBulkTests.cs
@@ -663,7 +663,7 @@ public sealed class SessionManagerBulkTests
     private static async Task<GatewaySession> OpenSessionAsync(IWorkerClient workerClient)
     {
         SessionManager manager = CreateManager(workerClient);
-        return await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        return await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
     }
 
     private static SessionManager CreateManager(IWorkerClient workerClient)
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerTests.cs
index 45134bf..cd527d9 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Sessions/SessionManagerTests.cs
@@ -23,7 +23,7 @@ public sealed class SessionManagerTests
         using GatewayMetrics metrics = new();
         SessionManager manager = CreateManager(factory, metrics: metrics);
 
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         Assert.True(manager.TryGetSession(session.SessionId, out GatewaySession? registered));
         Assert.Same(session, registered);
@@ -34,6 +34,36 @@ public sealed class SessionManagerTests
         Assert.Equal(1, metrics.GetSnapshot().SessionsOpened);
     }
 
+    /// <summary>Verifies that a session opened by an authenticated caller records that caller's API key id in OwnerKeyId.</summary>
+    [Fact]
+    public async Task OpenSessionAsync_WithOwnerKeyId_RecordsOwnerKeyIdOnSession()
+    {
+        SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(new FakeWorkerClient()));
+
+        GatewaySession session = await manager.OpenSessionAsync(
+            CreateOpenRequest(),
+            clientIdentity: "MyKey Display",
+            ownerKeyId: "key-abc123",
+            CancellationToken.None);
+
+        Assert.Equal("key-abc123", session.OwnerKeyId);
+    }
+
+    /// <summary>Verifies that a session opened without an owner key id records null in OwnerKeyId.</summary>
+    [Fact]
+    public async Task OpenSessionAsync_WithNullOwnerKeyId_RecordsNullOwnerKeyIdOnSession()
+    {
+        SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(new FakeWorkerClient()));
+
+        GatewaySession session = await manager.OpenSessionAsync(
+            CreateOpenRequest(),
+            clientIdentity: null,
+            ownerKeyId: null,
+            CancellationToken.None);
+
+        Assert.Null(session.OwnerKeyId);
+    }
+
     /// <summary>Verifies that opening a session sets the initial lease expiry from the configured default lease.</summary>
     [Fact]
     public async Task OpenSessionAsync_SetsInitialDefaultLease()
@@ -45,7 +75,7 @@ public sealed class SessionManagerTests
             options: options,
             timeProvider: clock);
 
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         Assert.Equal(clock.GetUtcNow() + TimeSpan.FromMinutes(30), session.LeaseExpiresAt);
     }
@@ -61,7 +91,7 @@ public sealed class SessionManagerTests
         };
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(new FakeWorkerClient()));
 
-        GatewaySession session = await manager.OpenSessionAsync(request, "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(request, "client-1", ownerKeyId: null, CancellationToken.None);
 
         Assert.Equal($"rust-load-client-{session.SessionId}", session.ClientCorrelationId);
     }
@@ -76,7 +106,7 @@ public sealed class SessionManagerTests
         };
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(new FakeWorkerClient()));
 
-        GatewaySession session = await manager.OpenSessionAsync(request, "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(request, "client-1", ownerKeyId: null, CancellationToken.None);
 
         Assert.Equal($"client-{session.SessionId}", session.ClientCorrelationId);
     }
@@ -87,7 +117,7 @@ public sealed class SessionManagerTests
     {
         FakeWorkerClient workerClient = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         WorkerCommandReply reply = await manager.InvokeAsync(
             session.SessionId,
@@ -108,6 +138,7 @@ public sealed class SessionManagerTests
             "mxaccess-gateway-1-session-lease-refresh",
             "nonce",
             "client-1",
+            null,
             "test-session",
             "client-correlation-1",
             TimeSpan.FromSeconds(30),
@@ -156,7 +187,7 @@ public sealed class SessionManagerTests
             },
         };
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         IReadOnlyList<SubscribeResult> results = await session.SubscribeBulkAsync(
             12,
@@ -207,7 +238,7 @@ public sealed class SessionManagerTests
             },
         };
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         IReadOnlyList<BulkWriteResult> results = await session.WriteBulkAsync(
             12,
@@ -268,7 +299,7 @@ public sealed class SessionManagerTests
             },
         };
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         IReadOnlyList<BulkReadResult> results = await session.ReadBulkAsync(
             12,
@@ -291,7 +322,7 @@ public sealed class SessionManagerTests
     {
         FakeWorkerClient workerClient = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
         session.MarkFaulted("test fault");
 
         SessionManagerException exception = await Assert.ThrowsAsync<SessionManagerException>(
@@ -316,7 +347,7 @@ public sealed class SessionManagerTests
     {
         FakeWorkerClient workerClient = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         // Force a state mismatch: session stays Ready, worker transitions out.
         workerClient.State = WorkerClientState.Handshaking;
@@ -341,7 +372,7 @@ public sealed class SessionManagerTests
         FakeWorkerClient workerClient = new();
         using GatewayMetrics metrics = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient), metrics: metrics);
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         SessionCloseResult firstClose = await manager.CloseSessionAsync(session.SessionId, CancellationToken.None);
         SessionManagerException secondClose = await Assert.ThrowsAsync<SessionManagerException>(
@@ -366,7 +397,7 @@ public sealed class SessionManagerTests
                 "Worker shutdown timed out."),
         };
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         SessionManagerException exception = await Assert.ThrowsAsync<SessionManagerException>(
             async () => await manager.CloseSessionAsync(session.SessionId, CancellationToken.None));
@@ -397,6 +428,7 @@ public sealed class SessionManagerTests
         GatewaySession firstSession = await manager.OpenSessionAsync(
             CreateOpenRequest(),
             "client-1",
+            ownerKeyId: null,
             CancellationToken.None);
         metrics.EventReceived(firstSession.SessionId, MxEventFamily.OnDataChange.ToString());
 
@@ -405,6 +437,7 @@ public sealed class SessionManagerTests
         GatewaySession secondSession = await manager.OpenSessionAsync(
             CreateOpenRequest(),
             "client-2",
+            ownerKeyId: null,
             CancellationToken.None);
 
         Assert.Equal(SessionManagerErrorCode.CloseFailed, exception.ErrorCode);
@@ -440,6 +473,7 @@ public sealed class SessionManagerTests
         GatewaySession session = await manager.OpenSessionAsync(
             CreateOpenRequest(),
             "client-1",
+            ownerKeyId: null,
             CancellationToken.None);
 
         Task<SessionCloseResult> firstClose = manager.CloseSessionAsync(session.SessionId, CancellationToken.None);
@@ -482,7 +516,7 @@ public sealed class SessionManagerTests
         FakeWorkerClient workerClient = new();
         using GatewayMetrics metrics = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient), metrics: metrics);
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         SessionCloseResult result = await manager.KillWorkerAsync(session.SessionId, "test-kill", CancellationToken.None);
 
@@ -510,7 +544,7 @@ public sealed class SessionManagerTests
     {
         FakeWorkerClient workerClient = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         await Assert.ThrowsAsync<ArgumentException>(
             async () => await manager.KillWorkerAsync(session.SessionId, blankReason, CancellationToken.None));
@@ -529,7 +563,7 @@ public sealed class SessionManagerTests
     {
         FakeWorkerClient workerClient = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
 
         await Assert.ThrowsAsync<ArgumentNullException>(
             async () => await manager.KillWorkerAsync(session.SessionId, null!, CancellationToken.None));
@@ -569,6 +603,7 @@ public sealed class SessionManagerTests
         GatewaySession session = await manager.OpenSessionAsync(
             CreateOpenRequest(),
             "client-1",
+            ownerKeyId: null,
             CancellationToken.None);
 
         Assert.Equal(1, metrics.GetSnapshot().OpenSessions);
@@ -598,6 +633,7 @@ public sealed class SessionManagerTests
         GatewaySession session = await manager.OpenSessionAsync(
             CreateOpenRequest(),
             "client-1",
+            ownerKeyId: null,
             CancellationToken.None);
 
         Task<SessionCloseResult> first = manager.KillWorkerAsync(session.SessionId, "kill-a", CancellationToken.None);
@@ -641,6 +677,7 @@ public sealed class SessionManagerTests
         GatewaySession session = await manager.OpenSessionAsync(
             CreateOpenRequest(),
             "client-1",
+            ownerKeyId: null,
             CancellationToken.None);
 
         Assert.Equal(1, metrics.GetSnapshot().OpenSessions);
@@ -666,7 +703,7 @@ public sealed class SessionManagerTests
             metrics);
 
         SessionManagerException exception = await Assert.ThrowsAsync<SessionManagerException>(
-            async () => await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None));
+            async () => await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None));
 
         Assert.Equal(SessionManagerErrorCode.OpenFailed, exception.ErrorCode);
         Assert.Equal(0, registry.Count);
@@ -682,8 +719,8 @@ public sealed class SessionManagerTests
         FakeWorkerClient activeClient = new();
         QueueingSessionWorkerClientFactory factory = new(expiredClient, activeClient);
         SessionManager manager = CreateManager(factory);
-        GatewaySession expiredSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
-        GatewaySession activeSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-2", CancellationToken.None);
+        GatewaySession expiredSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
+        GatewaySession activeSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-2", ownerKeyId: null, CancellationToken.None);
         DateTimeOffset now = DateTimeOffset.UtcNow;
         expiredSession.ExtendLease(now.AddSeconds(-1));
         activeSession.ExtendLease(now.AddMinutes(5));
@@ -703,7 +740,7 @@ public sealed class SessionManagerTests
     {
         FakeWorkerClient workerClient = new();
         SessionManager manager = CreateManager(new FakeSessionWorkerClientFactory(workerClient));
-        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
+        GatewaySession session = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
         DateTimeOffset now = DateTimeOffset.UtcNow;
         session.ExtendLease(now.AddSeconds(-1));
         using IDisposable eventSubscriber = session.AttachEventSubscriber(allowMultipleSubscribers: false);
@@ -724,8 +761,8 @@ public sealed class SessionManagerTests
         QueueingSessionWorkerClientFactory factory = new(firstClient, secondClient);
         using GatewayMetrics metrics = new();
         SessionManager manager = CreateManager(factory, metrics: metrics);
-        GatewaySession firstSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", CancellationToken.None);
-        GatewaySession secondSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-2", CancellationToken.None);
+        GatewaySession firstSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-1", ownerKeyId: null, CancellationToken.None);
+        GatewaySession secondSession = await manager.OpenSessionAsync(CreateOpenRequest(), "client-2", ownerKeyId: null, CancellationToken.None);
 
         await manager.ShutdownAsync(CancellationToken.None);
 
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/GatewayGrpcAuthorizationInterceptorTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/GatewayGrpcAuthorizationInterceptorTests.cs
index 0636d9a..5307034 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/GatewayGrpcAuthorizationInterceptorTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/GatewayGrpcAuthorizationInterceptorTests.cs
@@ -416,6 +416,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
         public Task<GatewaySession> OpenSessionAsync(
             SessionOpenRequest request,
             string? clientIdentity,
+            string? ownerKeyId,
             CancellationToken cancellationToken)
         {
             OpenSessionCount++;