Virtual keys, real guardrails.
Every deploy, agent and teammate gets a scoped key. Budgets, rate limits, model allow-lists and expiry live on the key — not in the app.
POST /v1/keys
{
"name": "agent-prod-router",
"budget_usd_month": 2000,
"rate_limit": { "rpm": 600, "tpm": 4000000 },
"allow_models": ["auto:quality", "anthropic/*", "openai/*"],
"allow_regions": ["us-east", "eu-west"],
"require_zero_retention": true,
"expires_at": "2026-12-31"
}Key features
Per-key spend caps
Daily and monthly USD budgets enforced at the router. Keys stop when they hit the cap.
RPM + TPM limits
Independent per-key rate limits — a runaway staging job can't starve production.
Model allow-lists
Restrict a key to auto:* policies, model prefixes or exact IDs. Ideal for cost-sensitive agents.
Region pinning
Constrain routing to us-east, eu-west or apac. Deny cross-region fallback when compliance requires.
One-click rotation
Rotate without redeploying. A 24h grace window lets both keys serve traffic while callers roll.
Full audit trail
Every key op lands in the audit log with actor, IP and diff. Exportable to your SIEM.
Can I map keys to end-users?+
Yes — attach a user_id and every request is attributed in analytics and audit. Great for per-tenant billing.
What happens when a key hits its budget?+
The router returns 402 with a Retry-After for the next reset. A webhook can trigger auto top-up.
Can end users bring their own keys?+
Yes — see BYOK. The router forwards with their credentials; you only pay any routing surcharge (nothing on free).