---
head:
  - - meta
    - name: description
      content: Create and manage your own OneGateway API keys, get the API URL, and set quota, expiration time, group pricing, available models, and IP restrictions.
---

# API Keys

API keys are the credentials applications use to call models through OneGateway. Create and manage your own keys on the **API Keys** page; the list shows only your keys.

The **API URL** at the top of the page is the address your application should target—click the icon on the right to copy it. Configure the API URL and API key according to the API format your application uses (OpenAI, Anthropic, and so on) to start calling; see [Quickstart](/en/guide/getting-started) for full request examples.

## Creating an API Key

Click **Create API Key** at the top right, fill in a **name**, and click **OK**. The name distinguishes purposes, such as "Chatbox key".

A key created this way has no quota limit, never expires, uses your group pricing, and can call all available models. To apply restrictions, expand **Advanced settings**:

| Field | Effect | When left empty |
| --- | --- | --- |
| Quota | The maximum this key can spend | No limit |
| Expiration time | The key stops working after this time | Never expires |
| Group Pricing | Determines the billing ratio for calls | Uses your group pricing |
| Available models | Restricts which models this key can call | All available models |

Which group pricing and models you can choose is configured by your administrator; see [Available Models](/en/user/models) for what you can call.

::: warning When using a virtual model such as `og-auto`

A key with restricted available models is checked against the **actual model** after [Intelligent Routing](/en/guide/intelligent-routing) rewrites it. Selecting only the virtual model name does not work: add every target and backup model it may use to the available models, otherwise the request returns 403 and does not switch to a backup model. Ask your administrator which models it may use.

:::

After creation, the key is masked on its card. Click the copy icon next to the key to get the full value and paste it into your application.

## Managing Existing Keys

Each card is one API key.

| Card item | Description |
| --- | --- |
| Name and group pricing | The key's name and the group pricing it uses, shown as "Group Pricing - name" |
| Quota | Shows "Unlimited" when no quota is set; otherwise **Remaining Quota**, used amount, and utilization |
| Status switch | Controls whether the key can make calls; after turning it off, confirm configuration sync and verify that requests using the old key are rejected |
| Available models | Shows "All models" when unrestricted |
| Expiration | The expiry date or "Never Expires"; expired keys are flagged |
| Key | Masked; click the icon on the right to copy the full key |

Three buttons at the top right of the card are for **Edit**, **View usage**, and **Delete**.

::: warning If a key may have leaked, switch it off first—don't delete it
Turn off the status switch first to retain the key's history, then confirm configuration sync and verify that calls are rejected. With semantic caching enabled, test both cache-hit and upstream request paths; see [revocation checks](/en/guide/faq#revoke-access). Delete only after confirming the key is no longer needed; deletion cannot be undone and affects applications using it.
:::

## Changing Restrictions

Click the card's edit button to open the detail page, make changes, then click **Update** at the top right.

| Area | What you can change |
| --- | --- |
| Basic info | Name and group pricing can be changed; department, user, status, key, and creation time are system-maintained |
| Quota and validity | Check **Unlimited**, or set a quota and an expiration time; shortcuts provide **Never**, **1 hour**, **1 day**, **1 month** |
| Access restrictions | Adjust **available models**; in **IP restrictions**, enter one allowed address per line—leave empty for no restriction |

After changing the group pricing or available models, make a call with the key and confirm in [Request Logs](/en/user/usage) that the model and cost match expectations.