🔑 API Key Management
API keys are the credentials used to access the API. Each key can have its own Channel, USD spending limit, expiration, model restrictions, and IP allowlist, making it easy to isolate usage by app, environment, or team.
⚡ Creating an API Key
On the API Key Management page, click "Create token", fill in the name and optional settings, then use "Copy key" after creation to get the full key.
⚠️ Warning
The full API key is displayed only once after creation. Copy and store it securely immediately. If it is lost, you must create a new key.
📋 API Key Settings
| Setting | Description |
|---|---|
| Name | Purpose identifier. Use clear names such as "Production", "Staging", or "Internal Tool". |
| Channel | Choose which route (Channel) this API key uses. The Channel decides which providers the key can reach. Which Channels you can pick depends on your account tier. |
| USD limit | Cap how many USD this API key can spend. "Unlimited USD limit" is available, but actual usage is still bounded by available in-plan usage, wallet balance, account policy, and this key's own limits. |
| Expiration | The API key automatically expires at the selected time. Useful for temporary projects, external collaborations, or short-term tests. |
| Model Restrictions | Restrict this API key to specific models. If left empty, it inherits the models allowed by the selected Channel and your account tier. |
| IP Allowlist | Restrict requests to specific IP addresses. Enable only when you have a clear need. |
🔄 Management & Rotation
- You can rename an API key at any time to distinguish it by project, environment, or owner.
- Refreshing generates a new full key and immediately invalidates the old one.
- Regular API keys can be deleted or disabled. A few system-provisioned keys cannot be deleted or disabled, but can still be renamed and refreshed.
- Create separate API keys for different apps or environments to reduce the blast radius if one leaks.
🚀 How to use this API Key
If you already have a key, go to Using API Key to start with the API URL and then integrate with Python, Node.js, cURL, or third-party clients.
⏱️ Rate Limiting
Each API key may be subject to account-level, Channel-level, and upstream route pool rate limits. If you hit a 429, reduce request frequency and wait for the rate limit window to recover.
🛡️ Security Best Practices
- Never expose API keys in frontend code, public repositories, screenshots, or chat logs.
- Create separate API keys for different apps and environments.
- Rotate API keys regularly and disable unused keys promptly.
- Follow least privilege: grant each API key only the models and USD limit it actually needs.
- If you suspect a leak, disable the old key immediately and create a new one.
👉 Next Steps
- Using API Key: API URL, Python, Node.js, and cURL integration
- Billing & Balance: review billing and top up
- Base URL & Auth: configure endpoint and auth
- Code Examples: see full code examples