Manage API keys · Confidential Router

Create a key, scope it to models, cap what it may spend, set its rate limits, edit it later, and revoke it.

Keys are standard OpenAI-compatible bearer tokens. A key belongs to the workspace it was created in and is shown in full exactly once.

Create a key

Open API Keys and click New key.
In New API key, fill in the fields below and click Create key.
The Copy your key now dialog shows the key once, with the client snippets already filled in. Copy it, then click Done.

The key is stored hashed, so it cannot be shown again. Lose it, and the only path is to revoke it and create another.

The fields

Field	Meaning	Validation
Name	What the key is called in the log	Required
Model scope	Unrestricted keys may call every model in the catalogue; tick Restrict this key to specific models to pick some	At least one model when restricted
Spend limit (USD)	A ceiling on what this key may spend, in dollars. Empty means no limit	A dollar amount such as `25` or `12.50`
Expires	A date; the key works all of that day, UTC. Empty means never
Requests per minute	This key's own request bucket; empty means the workspace default	A whole number above zero
Tokens per minute	This key's own token bucket; empty means the workspace default	A whole number above zero

A key's own limits never raise the workspace's: the workspace buckets apply on top. See Errors and limits.

Edit a key

From the row's menu choose Edit limits and scope. Every field above except the key itself can be changed; clearing a limit removes it.

Revoke a key

From the row's menu choose Revoke, then confirm with Revoke key. The next request made with the key is refused with 401 api_key_revoked. Revoking cannot be undone, and generations already metered against the key stay in the log.

The chat's key

The console chat mints a short-lived key of its own, scoped to chat-capable models and valid for 2 hours. It is held in the tab's memory and never listed here. See Chat.