API Key Management
An API Key authenticates calls to QuotaAPI. Split Keys by device, project, and environment so each can be limited, disabled, and audited independently.
Create a Key
Open API Key management and name each Key by purpose:
| Scenario | Suggested name |
|---|---|
| Local Claude Code | local-claude |
| Local Codex CLI | local-codex |
| Production service | production-api |
| Temporary test | temporary-test |
Store the new Key in an environment variable or secrets manager. Do not place it in browser code or a source repository.
One Key binds to one group
Each API Key has one group_id, so it binds to exactly one group:
- Create separate Keys when you need several ordinary groups.
- Use the protocol and Base URL that match the bound group's platform.
- A Composite group is still one group, but model mappings can resolve requests to multiple target platforms.
- Endpoint support for a Composite group follows the platform resolved for the current request; it does not enable every endpoint unconditionally.
Quota and expiration
| Setting | Meaning |
|---|---|
| Quota | USD amount this Key may consume; 0 means no Key-specific quota |
| Used quota | Billable amount already consumed by the Key |
| Expiration | Requests are rejected after this date; no date means no scheduled expiry |
| Status | Enabled, disabled, or deleted |
The Key quota does not replace the account balance check. A request can still fail when account balance is insufficient.
Rate limits
A Key can have separate 5-hour, 1-day, and 7-day limits. 0 means that window has no Key-specific limit. Leave room for normal retries and streaming requests instead of operating continuously at the boundary.
IP access rules
- Whitelist: when populated, only matching IP addresses or CIDRs may call the Key.
- Blacklist: matching IP addresses or CIDRs are rejected.
- Verify changes with a short request before applying them to production traffic.
- Behind a proxy or CDN, confirm which client IP the Gateway actually receives.
Rotate a Key
- Create a new Key bound to the same group.
- Update the client and send a short request.
- Confirm request records use the new Key.
- Disable the old Key, then delete it after residual traffic stops.
Disable a suspected leaked Key immediately instead of waiting for its quota to run out.
Common errors
401: the Key is missing, disabled, expired, or incomplete.403/404: the bound group does not match the model or endpoint.429: a Key time-window limit or platform rate limit was reached.- A fixed server is rejected: check the whitelist, CIDR, and proxy-visible source IP.