Managing keys

You create and revoke API keys in the Developer Console, on the API keys tab. The full key and the webhook signing secret are shown once, at creation — save them right away. How to send the key with requests is covered in Authentication.

Creating a keyCopy Anchor Link

Creating and rotating a key requires a recent sign-in: with an old session the console asks you to confirm your sign-in and then retries the action itself. The account owner gets an email about every key created and every key revoked in the console — see Owner emails.

What a key comes withCopy Anchor Link

An account can hold up to 20 active keys; expired keys and keys expiring within a day, such as those replaced by a rotation, don't count. Beyond that, creating a key returns 400 with the message api_key_limit_reached.

Expiry and budgetCopy Anchor Link

Expiry is set at creation and can't be extended: after the date, requests with the key get 401 invalid_api_key, and the key list marks it expired. To avoid downtime, rotate the key ahead of time, at least a day before it expires — the new key gets the same term, counted from the rotation.

Budget is a cap on the credits the key may spend: over the last day, 7 or 30 days (a sliding window) or over the key's whole lifetime. The owner sets it in the console when creating the key. Spending is counted from the charge ledger and this key's unfinished jobs — generations, LLM chat and MCP; refunded credits don't count.

A generation submit is rejected with 402 and the code insufficient_quota if it would take spending over the budget; a chat request, once spending has reached the budget. Simultaneous requests can go slightly over it. Reading a result, a status or the catalog is never blocked by the budget. A rejected submit looks like this:

{
  "error": {
    "type": "billing_error",
    "code": "insufficient_quota",
    "message": "This request does not fit the remaining API key budget for the current period."
  }
}

In chat the same code comes in the OpenAI envelope with type: insufficient_quota. Spending that leaves the window makes room in the budget; a lifetime budget doesn't regain room on its own. A budget limits one key and doesn't change the account balance: it doesn't protect against spending through other keys. After a rotation, the new key's count starts from zero.

Rotating a keyCopy Anchor Link

Click Rotate next to an active key. The console creates a new key with the same name, environment, permissions, limits and budget and shows its full key and webhook signing secret — once, as at creation. The old key keeps working for 24 more hours, then expires on its own — no need to revoke it. A key that expires within a day, including one already rotated, can't be rotated: the request returns 409 with the code api_key_rotation_unavailable, so create a new key instead.

Zero-downtime order: rotate → update the key and the secret in your integration and webhook handler → confirm requests are coming from the new key. Each key has its own secret, and webhooks for jobs submitted with the old key are signed with the old one. Keep both secrets in your handler until those deliveries end: retries run for about 24 hours after the job finishes.

Owner emailsCopy Anchor Link

The account email receives service notifications about access events: API key created (with the name and the last four characters; for a rotation, which key was replaced), key revoked (a password reset sends no separate revocation email) and app connected (a new OAuth connection, for example Claude or ChatGPT). Secrets never appear in emails. If an event isn't yours, revoke the key or disconnect the app in the console and change your password.

Revoking a keyCopy Anchor Link

Click Revoke next to the key in the list. Revocation takes effect immediately, or within a minute at most. After that, requests with the key get 401 invalid_api_key.

Key usageCopy Anchor Link

The console's Logs tab shows requests by key; for a rejected request the log stores the error code (invalid_request, not_found), not its text. GET /v1/account returns a 30-day summary for the current key, and LLM clients can use GET /v1/key.