API keys

Updated

An API key decides who can call, which models they can call and how much they can spend. An account can hold up to 50 active keys at a time (revoked and expired keys do not count). Use one per app or environment so you can stop just one when something goes wrong.

The full key is shown once

  • Full keys start with mp- (older keys start with key_ and keep working). The full key appears only once, in the dialog shown right after creation, so copy it then.
  • After the dialog closes, the Keys page and the API show only the last 4 characters. The platform stores only a hash of the key, so administrators cannot see it either.
  • If you lose a key, revoke it and create a new one.

Pause and revoke

Action Effect
Pause / resume New requests with a paused key are refused; resuming works immediately
Revoke Disables the key permanently

Paused and expired keys return key_inactive; revoked and mistyped keys return invalid_api_key. Both are HTTP 401. Keys are checked when a request starts, so calls already in progress finish and are billed normally.

Restricting a key

When creating or editing a key, you can set its own:

  • Allowed models: only the listed models can be called; empty means all models. Calling another model returns key_restricted (HTTP 403).
  • Daily / monthly spend limit in the instance currency. The check uses the estimated cost before each call, so one call may push actual spend slightly past the limit; later calls are refused with budget_exceeded (HTTP 402). Days and months roll over in UTC.
  • IP allowlist of single IPs or CIDR ranges. Requests from elsewhere return key_restricted (HTTP 403).
  • Expiry time, after which the key stops working.

Security tips

  • Keep keys in server-side environment variables or a secret manager. Never ship them in frontend code, mobile apps or public repositories.
  • Send keys in headers only (Authorization: Bearer, or x-api-key for Anthropic). Keys in URL parameters are always rejected.
  • If you suspect a leak, revoke the key and create a new one, then check that key's calls in usage.

FAQ

I forgot to save my key. What now?
The full key is shown only once, at creation. The platform keeps only a hash, so nobody can see it again. Revoke that key and create a new one.
How many keys can I create?
An account can hold up to 50 active keys at a time; revoked and expired keys do not count. Contact support if you need more.
Does pausing a key stop requests already running?
No. Keys are checked when a request starts, so running requests finish and are billed; only new requests are refused.
Why did spend go slightly over the limit?
The limit is checked against each call's estimated cost before it runs, so one call's actual cost can push the total a little past it. Later calls are refused.