Virtual keys, real guardrails.
Every deploy, every agent, every teammate gets its own scoped key. Budgets, rate limits, model allow-lists and expiry live on the key — not in the app.
POST /v1/keys
{
"name": "agent-prod-router",
"budget_usd_month": 2000,
"rate_limit": { "rpm": 600, "tpm": 4000000 },
"allow_models": ["auto:quality", "anthropic/*", "openai/*"],
"allow_regions": ["us-east", "eu-west"],
"require_zero_retention": true,
"expires_at": "2026-12-31"
}Key features
Per-key spend caps
Daily and monthly USD budgets enforced at the router. Keys stop accepting requests when they hit the cap.
RPM + TPM limits
Independent per-key rate limits — protect a production key from a runaway backfill on staging.
Model allow-lists
Restrict a key to specific auto:* policies, model prefixes or exact model IDs. Perfect for cost-sensitive agents.
Region pinning
Constrain routing to us-east, eu-west, apac. Deny cross-region fallback when compliance requires it.
One-click rotation
Rotate a key without redeploying — a 24h grace window lets both keys serve traffic while callers roll.
Full audit trail
Every key operation lands in the audit log with actor, IP and diff. Exportable to your SIEM.
Can I map keys to end-users?+
Yes — attach a user_id to a key and every request is attributed in analytics and audit logs. Great for per-tenant billing.
What happens when a key hits its budget?+
The router returns 402 Payment Required with a Retry-After header pointing to the next reset window. You can subscribe to a webhook to top up automatically.
Can end users bring their own keys?+
Yes — see BYOK. The router forwards to the provider using the end-user's own credentials and only bills you for the routing surcharge (or nothing, on the free tier).