---
head:
  - - meta
    - name: description
      content: Administrators review and manage all members' API keys in OneGateway, create new keys on behalf of members, and adjust quotas, validity, group pricing, available models, and IP restrictions.
---

# Managing API Keys

Administrators review and manage all members' keys on the **API Keys** page, create new keys on behalf of members, and adjust restrictions on existing keys. For members creating and using their own keys, see [API Keys](/en/user/tokens).

## Finding Keys

The list is a table of all API keys within your permissions, with columns such as **Key Name**, **Owner**, **Status**, **Quota**, **Group Pricing**, **Allowed Models**, **IP Allowlist**, and **Expires On**. Pick a field at the top left and type a keyword to search, use the filter entry at the top right to narrow the scope, and adjust the page size and paginate at the bottom.

## Creating a New Key for a Member

Click **New** at the top right, pick a member, and enter a name.

| Field | Guidance |
| --- | --- |
| Department | Optional. When selected, the member list shows only people in that department |
| Member | Required. The key's owner—calls on it are billed to this member |
| Name | Required. Distinguishes the key's purpose |

To apply restrictions, expand **Advanced settings**. Quota, expiration time, group pricing, and available models behave the same as on the member side: empty means unlimited, never expires, the member's own group pricing, and all available models respectively.

::: warning When using a virtual model such as `og-auto`

A key with restricted available models is checked against the **actual model** after [Intelligent Routing](/en/guide/intelligent-routing) rewrites it. Selecting only the virtual model name does not work: add every target and backup model it may use to the available models, otherwise the request returns 403 and does not switch to a backup model. The target and backup models are defined by the Intelligent Routing rules.

:::

After creation, the key is masked in the list. When handing the full key to the member, deliver it through a secure channel.

## Adjusting Existing Keys

Click a name in the list to open the detail page, make changes, then click **Update** at the top right; click **Delete** when the key is no longer needed.

| Area | What you can change |
| --- | --- |
| Basic info | Name and group pricing can be changed; department, user, status, key, and creation time are system-maintained |
| Quota and validity | Check **Unlimited**, or set a quota; set an expiration time, with shortcuts for **Never**, **1 hour**, **1 day**, **1 month** |
| Access restrictions | Adjust **available models**; in **IP restrictions**, enter one allowed address per line—leave empty for no restriction |

::: warning Deleting affects the member's calls
Deletion cannot be undone and affects applications using the key. When revoking access after a leak or an employee's departure, disable access first and confirm sync results. With semantic caching enabled, verify both cache-hit and upstream request paths; see [revocation checks](/en/guide/faq#revoke-access). Changing the group pricing or available models also affects running applications—confirm with the users first.
:::

## When a Member Reports Call Failures

| Symptom | Where to check |
| --- | --- |
| Invalid key | Whether the key was deleted, and whether the member is using the latest key |
| Insufficient quota | Check the remaining quota in the list. If the key's quota is exhausted, raise it; if the member's account quota is exhausted, top up via [Quotas & Redemption](/en/admin/quota) |
| Key expired | Set a new expiration time on the detail page |
| Model not found or no permission | Check the key's available models, and whether a provider serving the model has the key's group pricing selected; see [Group Pricing](/en/admin/providers-and-models#group-pricing) |
| Some machines can call, others can't | Check whether the IP restrictions cover those machines' egress addresses |
| Status is expired or exhausted | These keys need an extended validity or a quota top-up before calls can resume |

To verify a specific call, filter [Request Logs](/en/user/usage) by user and API key.