API Keys

Create, scope and rotate the keys your code authenticates with. A key is the only credential the gateway needs — same key for every model and every endpoint.

In the console sidebar (it appears once the feature applies to your account): API keys Open it ↗

Steps

1. Open API keys and press Create key.
2. Give it a name you will recognise in six months — the name is how you tell keys apart when rotating.
3. Set the limits it should carry: a spending quota with a reset interval, an allowed-model list, an IP allowlist, and an expiry date. All are optional — a key with none of them can call any model your workspace has access to.
4. Copy the key immediately and put it in your secret store. Then send it as Authorization: Bearer <key>.

Limits and gotchas

• A key is shown exactly once. There is no way to reveal it again — if it is lost, delete it and create another.
• Deleting a key takes effect immediately. Rotate by creating the new key, deploying it, then deleting the old one — in that order.
• Keys belong to a workspace. Switching workspace switches which keys you see, and a key never reaches across.

API reference for the same thing: Claves API