Managing API Keys

Administrators review and manage all members' keys on the API Keys page, create new keys on behalf of members, and adjust restrictions on existing keys. For members creating and using their own keys, see API Keys.

Finding Keys

The list is a table of all API keys within your permissions, with columns such as Key Name, Owner, Status, Quota, Group Pricing, Allowed Models, IP Allowlist, and Expires On. Pick a field at the top left and type a keyword to search, use the filter entry at the top right to narrow the scope, and adjust the page size and paginate at the bottom.

Creating a New Key for a Member

Click New at the top right, pick a member, and enter a name.

Field	Guidance
Department	Optional. When selected, the member list shows only people in that department
Member	Required. The key's owner—calls on it are billed to this member
Name	Required. Distinguishes the key's purpose

To apply restrictions, expand Advanced settings. Quota, expiration time, group pricing, and available models behave the same as on the member side: empty means unlimited, never expires, the member's own group pricing, and all available models respectively.

When using a virtual model such as og-auto

A key with restricted available models is checked against the actual model after Intelligent Routing rewrites it. Selecting only the virtual model name does not work: add every target and backup model it may use to the available models, otherwise the request returns 403 and does not switch to a backup model. The target and backup models are defined by the Intelligent Routing rules.

After creation, the key is masked in the list. When handing the full key to the member, deliver it through a secure channel.

Adjusting Existing Keys

Click a name in the list to open the detail page, make changes, then click Update at the top right; click Delete when the key is no longer needed.

Area	What you can change
Basic info	Name and group pricing can be changed; department, user, status, key, and creation time are system-maintained
Quota and validity	Check Unlimited, or set a quota; set an expiration time, with shortcuts for Never, 1 hour, 1 day, 1 month
Access restrictions	Adjust available models; in IP restrictions, enter one allowed address per line—leave empty for no restriction

Deleting affects the member's calls

Deletion cannot be undone and affects applications using the key. When revoking access after a leak or an employee's departure, disable access first and confirm sync results. With semantic caching enabled, verify both cache-hit and upstream request paths; see revocation checks. Changing the group pricing or available models also affects running applications—confirm with the users first.

When a Member Reports Call Failures

Symptom	Where to check
Invalid key	Whether the key was deleted, and whether the member is using the latest key
Insufficient quota	Check the remaining quota in the list. If the key's quota is exhausted, raise it; if the member's account quota is exhausted, top up via Quotas & Redemption
Key expired	Set a new expiration time on the detail page
Model not found or no permission	Check the key's available models, and whether a provider serving the model has the key's group pricing selected; see Group Pricing
Some machines can call, others can't	Check whether the IP restrictions cover those machines' egress addresses
Status is expired or exhausted	These keys need an extended validity or a quota top-up before calls can resume

To verify a specific call, filter Request Logs by user and API key.