Skip to main content
API keys authenticate API calls, SDKs, and external tools. Treat each key as access to your account balance.

​
Create a key

Open API Keys and create a key. The usual flow is:
  1. Enter a name. Use the project name, environment, or tool name, such as prod-web or cursor-local.
  2. Set an expiration date. Temporary test keys should use a short expiry.
  3. Set a quota. Unlimited quota is on by default; turn it off and enter a cap when you want cost control.
  4. Restrict models and source IPs when needed. Only allow the models your project needs, or fixed egress IPs.
  5. Choose a group. Groups are only for organizing keys in the list; they do not affect permissions, quota, or routing.
  6. Create multiple keys if needed. Fill in the quantity when you want several keys with the same settings.
If your page shows “Cross-group retry”, it is only for automatic fallback. The group itself is still just a management label.
The full key is shown only once. If it is lost, create a new key.

​
Use a key

OpenAI-compatible requests use:
SDKs usually accept only the raw key value, without the Bearer prefix.

​
Manage keys

  • View usage for a key.
  • Edit quota, expiration, model limits, IP limits, and group.
  • Disable a key temporarily.
  • Delete exposed or unused keys permanently.
Groups are only for organization and filtering; they do not change access control or request results.

​
Security practices

  • Use separate keys for development, production, automation, and external clients.
  • Set quota limits for browser plugins, desktop clients, and temporary tests.
  • Store keys in environment variables or a secret manager.
If a key is exposed, delete or disable it immediately, create a new key, update your app, and review Usage for abnormal calls.

​
Next steps