API keys
Only endpoints that intentionally differ from the standard API carry a chip; the chip links to the note that explains the difference.
Two credentials for two surfaces. Inference takes a Bearer ar- key (or x-api-key header); the dashboard takes a session cookie. An ar- key never acts as a session, and a session cookie never authenticates inference.
/api/dashboard/keys/api/dashboard/keys/{id}Key lifecycle without support
Create keys with POST /api/dashboard/keys under your session. The key secret is shown in full exactly once at creation (prefixed with ar- followed by 48 hex characters) — save it immediately. Listing keys with GET /api/dashboard/keys returns a 12-character preview only. Revoking with DELETE /api/dashboard/keys/{id} immediately and permanently deletes the key.
DELETE /api/dashboard/keys/{id}) and create a new one; the old key stops working immediately, with no grace window. There is no read-only or config key kind — every user key is a full inference key. Grace rotation and read-only keys are not available today; treat them as roadmap, not as features, and rotate with manual overlap.Lifecycle operations
| Action | Endpoint | Auth | Effect |
|---|---|---|---|
| Create | POST /api/dashboard/keys | Session | 201; full ar- key shown exactly once |
| List | GET /api/dashboard/keys | Session | Key entries with a prefix-only preview, never the full secret |
| Revoke | DELETE /api/dashboard/keys/{id} | Session | Immediate hard delete |
| Revoke, bad id | DELETE /api/dashboard/keys/{id} | Session | 400 invalid key id |
| Revoke, unknown id | DELETE /api/dashboard/keys/{id} | Session | 404 key not found |
Key properties
| Field | Meaning |
|---|---|
| name | Your label for the key. |
| rate_limit | Requests per minute for your whole account (all keys combined). Absent: 500/min. Explicit: 1..1000 — anything else (including 0 and negatives) is rejected with 400. |
| allowed_models | Optional allowlist of model IDs. Calls to any model outside the list are rejected with 403. |
| enabled | Keys carry no toggle: revoking deletes the key immediately, and subsequent calls return 401. |
| requests, last_used, created_at | Read-only telemetry returned by list. |
Set price limits for one key
Create a key, store its secret, then follow Set price budget beside the new key or Manage price budgets in API Keys. Budgets opens with that key selected. Choose All models for coverage across eligible paid models, or choose a family or exact model for narrower coverage, set a minimum discount, and save. Creating a key does not create a budget automatically.
The key summary counts account limits and that key’s limits separately, including percentage rules and fixed model rates. A model-only rule does not cover the rest of the key’s traffic. All matching account and key limits intersect; the strictest input and output ceilings win. With no saved rules, catalogue price limits still apply. Budgets limit token rates, not total spend; the paid-request minimum still applies.
The session-authenticated Playground uses account rules only. It does not exercise a particular API key’s budgets. Test key-specific behavior through your client using that key. Read Budgets for API examples and Setup helper for client configuration.
Roadmap, not features
| Capability | Status | Operation today |
|---|---|---|
| Grace-window rotation | Absent — delete is immediate and hard | Manual overlap: create new key, shift traffic, then delete old key |
| Read-only / config-scoped keys | Absent — only allowed_models exists | Separate keys per app, narrow each allowlist |
| Automated balance-check + key-creation snippets | Not yet offered | Use the dashboard, or adapt the curl examples on this page |