API keys

An API key belongs to one project and carries its own scopes, rate limits and budgets. Everything here is in the console under API keys. Owners, admins and members can create, edit, rotate and revoke keys. Billing and viewer roles can read the list and the key pages, and see the buttons disabled with the reason.

The key list

The list shows the keys of the environment you have selected in the console, live or test. Each row has:

• Name, which opens the key's own page.
• Hint: the key's prefix and the first characters of its secret, enough to recognise it. The full secret is never shown again after creation.
• Project and Scopes.
• Status: active, expiring (it expires within 7 days), rotating (two secrets work, with the time the old one stops), expired or revoked.
• Limits: requests per minute, tokens per minute and concurrency, or plan defaults.
• Budget: the daily budget, if the key has one.
• Last used.

Use the Status filter to show only keys in one status. The filter is kept in the page address, so you can share or reload a filtered view. When there are more keys than fit, Older keys loads the next page.

Create a key

1. Press Create key.
2. Enter a Name and choose the Project. The project's environment, live or test, decides the key's prefix.
3. Tick the Scopes the key needs (see below). inference is ticked by default.
4. Set anything else you need from the options below, then press Create key.

The key appears once at the top of the list, with a Copy button. Store it now: after you leave the page it cannot be displayed again. Tick I have stored it, then press Done. If you lose a key, rotate it to get a new secret.

Every new key is also announced by e-mail to the organization's owners and admins, so a key nobody expected is noticed.

Scopes

Give a key only the scopes its job needs. A key used by an application to call models needs inference and nothing else.

Rate limits

Under Limits, set the key's requests per minute, tokens per minute and concurrency. The form starts at your plan's maximum and shows it. A value above the plan maximum disables Create key; to go higher, ask for an increase on the limits screen. What each limit means, and the headers that report it, are in rate limits.

Budgets

Under Budgets (USD), enter a daily budget, a monthly budget, or both.

• With Hard budget ticked, requests are rejected with a 402 once the budget is spent.
• With it cleared, the budget is soft: requests continue and you are only alerted.

A key's budget and its project's budget are two separate ceilings, and whichever is reached first applies. The error says whose ceiling it was. Budget events are also sent to your webhooks.

Model allow and deny lists

Model allow-list limits the key to the models you name. You can use patterns such as openai/*. Leave it empty to allow every model. Model deny-list blocks the models you name.

A model name is resolved before the lists are checked, so a list entry and a request can use either the model's id or its alias. A denied model stays denied whichever name the request uses.

IP allow-list

IP allow-list (CIDR) restricts the key to the address ranges you enter. Leave it empty to allow any address.

Browser origins

By default a key is for server-side use only: a request sent from a web page in a browser is refused. Browser origins lists the web pages that may use the key from a browser. Enter one per line:

• https://app.example.com for one site;
• https://*.example.com for every subdomain (this does not include the bare domain);
• http://localhost:5173 for local development. Plain http is accepted only for a local address.

A key can list up to 20 origins. A browser request from any other page is refused with origin_not_allowed before anything is billed.

Listing an origin does not make a key safe to publish. Anyone who copies the key can still call with it from a server, so give a browser key a budget and an expiry.

Expiry

Expires sets the date and time the key stops working. Leave it empty for a key that does not expire, unless your organization's security settings give new keys a default expiry.

Seven days before a key expires, its status changes to expiring, the organization's owners and admins receive one e-mail listing the keys about to expire, and a key.expiring event goes to your webhooks. An expired key cannot be revived; create a new one.

Response cache

Tick Cache identical responses to have an exact repeat of a request served from cache, for up to an hour, at no cost. It is off unless you turn it on. Requests that use tools or a structured output schema are never cached, and neither are requests under a zero data retention policy. A cached answer still appears in your usage and request history, marked as a cache hit.

This option is set when the key is created.

Payload logging

Payload logging is inherit, on or off. A key can turn logging off for its own requests. It cannot turn logging on when the project or the organization has it off. See data policy.

API version pin

API version pin takes an aiml-version date in the form YYYY-MM-DD. Leave it empty to pin the key to today's version.

Default app

Default app attributes the key's requests to one of your registered apps whenever a request names no app itself. Choose an app from the list, or leave it at None.

The key page

Click a key's name to open its page. It shows the hint, project, scopes, created and last used times, expiry, API version, IP allow-list and browser origins, and three panels:

• Requests · 7 days: the request count, a small chart, and the amount spent.
• 429s · 24 h: how many requests were refused by each of the key's limits, with provider capacity refusals shown separately because they are not counted against you. When live figures are available, it also shows what is left of the key's limits right now.
• Budget: today's and this month's spend against the key's budgets.

An Audit trail at the bottom records when the key was created, rotated and revoked.

Change the default app

Under Default app, choose one of your registered apps and press Save default app. Choose None to clear it.

Change the budget

In the Budget panel, edit the daily or monthly amount or the hard tick box, then press Save budget. Clear a field to remove that budget.

When a key has spent its hard daily budget, the page shows a red notice: requests fail with budget_exceeded until tomorrow or until you raise the budget.

Change the rate limits

Under Limits, edit rpm, tpm or concurrency and press Save limits. Changes apply immediately. Values above the plan maximum cannot be saved; use the limits screen to ask for more.

Change the browser origins

Under Browser origins, edit the list, one origin per line, and press Save origins. Emptying the list stops all browser use of the key.

Rotate a key

Press Rotate (1 h grace). The new secret is shown once, exactly as at creation. For one hour both the old and the new secret work, and the page says until when. After that only the new one works. Use the hour to deploy the new secret.

Only an active key can be rotated.

Revoke a key

Press Revoke, on the key page or on its row in the list, type the key's name to confirm, and press Revoke key. Requests with the key fail with key_revoked immediately. Revoking cannot be undone. A key.revoked event goes to your webhooks.

Related

• Projects group keys and add their own budget, model lists and data policy.
• Keys API reference for managing keys from code.
• Errors for the codes named on this page.