API keys belong to an organization and are managed in the app under API keys. Usage made with a key is billed to the organization's wallet.
Format
sk-aip-<prefix>-<secret>The key starts with sk-aip-, followed by an 8-character prefix and a 32-character secret, both letters and digits. The prefix identifies the key in lists and usage records; the app shows a key as the prefix and its last four characters.
Shown once
The full key is displayed once, when you create it. The platform stores only the prefix and a keyed hash of the secret, so a lost key cannot be recovered. Create a new key, switch your applications to it, then revoke the old one. A revoked key stops working within about 10 seconds.
Restrictions
Each key can carry its own limits. All are optional.
| Restriction | Effect |
|---|---|
| Name | A label for you, up to 80 characters. |
| Monthly cap | Maximum spend for the key per calendar month (Asia/Dhaka time), in BDT. Requests that would exceed it fail with 429 key_cap_exceeded and a Retry-After until the next month starts. The cap counts completed spend plus holds of requests still running. |
| Requests per minute | Overrides the default per-key rate limit. See Rate limits. |
| Allowed models | The key can call only the listed model ids (up to 50). Other models fail with 403 model_not_allowed, and GET /v1/models lists only the allowed ones. |
| IP allowlist | Up to 20 addresses or CIDR ranges. Requests from elsewhere fail with 403 ip_not_allowed. |
| Expiry | After this date the key fails with 401 invalid_api_key. |
The number of active keys per organization is limited by a platform setting.
Good habits
- Use one key per application or environment, so you can revoke one without touching the others.
- Give production keys a monthly cap and an allowlist of the models they need.
- Rotate keys on a schedule and whenever someone with access leaves.
See also Authentication and Best practices.