# API keys

https://modelportal.ai/docs/api-keys

An API key decides who can call, which models they can call and how much they can spend. An account can hold up to 50 active keys at a time (revoked and expired keys do not count). Use one per app or environment so you can stop just one when something goes wrong.

## The full key is shown once

- Full keys start with `mp-` (older keys start with `key_` and keep working). The full key appears only once, in the dialog shown right after creation, so copy it then.
- After the dialog closes, the Keys page and the API show only the last 4 characters. The platform stores only a hash of the key, so administrators cannot see it either.
- If you lose a key, revoke it and create a new one.

## Pause and revoke

| Action | Effect |
| --- | --- |
| Pause / resume | New requests with a paused key are refused; resuming works immediately |
| Revoke | Disables the key permanently |

Paused and expired keys return `key_inactive`; revoked and mistyped keys return `invalid_api_key`. Both are HTTP 401. Keys are checked when a request starts, so calls already in progress finish and are billed normally.

## Restricting a key

When creating or editing a key, you can set its own:

- **Allowed models**: only the listed models can be called; empty means all models. Calling another model returns `key_restricted` (HTTP 403).
- **Daily / monthly spend limit** in the instance currency. The check uses the estimated cost before each call, so one call may push actual spend slightly past the limit; later calls are refused with `budget_exceeded` (HTTP 402). Days and months roll over in UTC.
- **IP allowlist** of single IPs or CIDR ranges. Requests from elsewhere return `key_restricted` (HTTP 403).
- **Expiry time**, after which the key stops working.

## Security tips

- Keep keys in server-side environment variables or a secret manager. Never ship them in frontend code, mobile apps or public repositories.
- Send keys in headers only (`Authorization: Bearer`, or `x-api-key` for Anthropic). Keys in URL parameters are always rejected.
- If you suspect a leak, revoke the key and create a new one, then check that key's calls in [usage](/docs/usage?lang=en).

## FAQ

### I forgot to save my key. What now?

The full key is shown only once, at creation. The platform keeps only a hash, so nobody can see it again. Revoke that key and create a new one.

### How many keys can I create?

An account can hold up to 50 active keys at a time; revoked and expired keys do not count. Contact support if you need more.

### Does pausing a key stop requests already running?

No. Keys are checked when a request starts, so running requests finish and are billed; only new requests are refused.

### Why did spend go slightly over the limit?

The limit is checked against each call's estimated cost before it runs, so one call's actual cost can push the total a little past it. Later calls are refused.