Scope and protect API keys
Limit each key by model, spend, rate and funding so a leak stays small.
Allowed models
- ScreenKey form
- ActionAllowed models
- Result403 for others
Name it, set limits, createThe secret is shown once
Example dataA list of endpoint names or raw ids. Calls to anything else return 403 model_not_allowed. Null allows every model.
Spend and rate limits
- ScreenKey row
- ActionLimits
- Result403 or 429
Read the key rowPrefix, limits, funding and spend
Example dataThe daily limit counts the last 24 hours; the total limit counts the key lifetime. Allowance calls count cost plus fee, paid calls cost plus fee plus markup. Over a limit: 403 key_limit_reached. Over rpm or 10 open calls: 429 rate_limited.
Public label
- ScreenLabel
- ActionPublic log
- ResultOr private
Open ActivityEach finished call arrives as a row
Example dataPaid calls show the label as the caller in public logs, for example app:kanji-tutor. Set it to private to hide it.
Disable, delete, replace
- ScreenKey menu
- ActionDisable or delete
- ResultCreate a new one
Read the key rowPrefix, limits, funding and spend
Example dataA disabled key gets 403 key_disabled. Deleting removes it; receipts keep only an HMAC of its id. Key management uses your signed-in session (/api/v1/me/keys); an API key cannot create keys.