API Keys

Keys are the unit of access, scoping and revocation. The dashboard manages them; the API only ever shows the secret once.

CreateName the key and optionally set an expiry, an allowed-model list and IP ranges. The secret is shown once.

ScopeNarrow an existing key to fewer models or networks, rename it, or shorten its lifetime.

RotateIssue a new secret and invalidate the old one in the same instant; the scope carries over.

RevealShow the stored secret again for recovery. Audited, so use it sparingly.

RevokePermanently disable the key. Its next request fails with 401.

Hygiene that pays off

One key per environment — local, staging, prod — so incidents can be isolated.
Set expiresInDays on temporary keys so abandoned credentials die on their own.
Narrow allowedModels to the models a service actually uses.
Pin ipCidrs to your egress range when the client runs on known infrastructure.
Rotate on staff changes and on any suspicion of exposure — rotation is instant and free.