API Keys

API keys authenticate model requests and charge usage to the account balance they belong to. The console calls them tokens; both terms refer to the same credential.

Create and store a key

Open Token Management, create a key, and copy it immediately. The complete key is shown only once.

Store the key in a server-side environment variable. Do not embed it in browser code, mobile application bundles, screenshots, or public repositories.

Control access

Each key can have its own status, expiration date, spending cap, requests-per-minute limit, tokens-per-minute limit, and concurrency limit. Use separate keys for development, testing, and production so one environment can be disabled without affecting the others.

If a key is exposed

Disable or delete the key immediately, create a replacement, and update the affected service. Review request logs for activity you do not recognize.