Skip to main content
/v1/models and /v1/chat/completions use API keys; /v1/manage/* uses management keys. See Management API. GET /health is public.

​
Create a key

  1. Sign in to the console.
  2. Confirm that Overview → Live model service is enabled. Before activation, inference and management key creation is disabled; request activation first. A top-up alone does not complete activation.
  3. Open API Keys and create a key with a descriptive name.
  4. Copy the key immediately.
Copy the key when it is created. To see it again later, choose View in the key list and confirm it’s you with a passkey or an emailed code. Keys created before this was available store only a SHA-256 hash and cannot be shown again; rotate one to get a viewable replacement.

​
Revoke a key

Revoking a key in the console takes effect on the next request. Requests with a revoked or unknown key return:

​
Keys follow the account

A key belongs to one person inside a workspace, so it works only while that account does. Two workspace actions revoke keys without anyone opening the key list:
  • An owner or admin suspends a member. Every key that member holds returns 401 unauthorized from the next request.
  • A member deletes their own account. Deletion revokes their keys immediately and ends their sessions. The account row is kept for a grace period so past usage can still be reconciled, but the keys never come back.
Other members’ keys are unaffected either way. If a service has to outlive the person who set it up, issue its key from an account that stays.

​
Per-key budgets

A key can carry an optional lifetime budget in micro-USD. Real calls require available key allowance to cover the reservation. Insufficient allowance returns 402 inference_budget_or_access_denied; other keys keep working.

​
Limit a key to some models

A key can be limited to the models it needs. In Key settings (or when creating a key), turn on Only let this key call the models selected and choose:
  • A whole provider, such as all Anthropic models. This covers models the provider adds later.
  • Individual models, by ID.
With a limit in place:
  • A call to any other model returns 403 model_not_allowed. It is recorded on the Usage page as a failed request and is never charged.
  • GET /v1/models lists only the models the key may call, so an SDK or tool never offers one that would be refused.
  • Rotating the key keeps the limit. Turning the limit off opens every model in the workspace again.
Real playground calls and the API debug tool use the key you select and enforce its model restrictions, budget and expiry.

​
Keep keys server-side

  • Store keys in environment variables or a secret manager.
  • Never ship a key in browser or mobile code, and never commit one to a repository.
  • Use one key per service so a leak can be revoked without downtime elsewhere.

​
Console accounts and sessions

Console sign-in uses a browser session, distinct from inference and management keys. Use the avatar menu to Add account, then switch between saved accounts without merging their workspaces or balances. An expired session requires signing in again. Signing out affects the selected browser account; it does not revoke that account’s API keys. Revoke keys separately under API Keys when required. View your login activity under Settings → Login history. See User manual and Data handling.