API Key Management

An API Key is the credential used to call QuotaAPI. One account can create multiple keys for different devices, projects or clients, making it easier to disable and audit them independently.

Creation guidelines

Open API Key management in the console and create keys by use case:

Scenario	Recommendation
Local CLI	Create one key per device
Server-side project	Create separate keys for dev, staging and production
Team members	Avoid sharing one key across multiple people
Temporary test	Disable or delete after use

Groups and models

QuotaAPI uses groups to control access to model families:

Group type	Common clients
Claude	Claude Code, Anthropic Messages
OpenAI / GPT	Codex CLI, OpenAI SDKs, compatible agent frameworks
Gemini	Gemini CLI, Gemini v1beta
DeepSeek	OpenAI-compatible SDKs or compatible clients

If one account needs access to several model families, enable the corresponding groups for the key or account. Client-side configuration still depends on the protocol and Base URL.

Security practices

1. Do not commit keys to Git repositories.
2. Do not expose keys in browser frontend code.
3. Do not include keys in public screenshots, logs or support tickets.
4. Use environment variables or secret management for server-side calls.
5. Review request records regularly and disable suspicious keys immediately.

Rotating a key

To replace a key:

1. Create a new key.
2. Update client or server environment variables.
3. Verify the new key with a short request.
4. Disable the old key.
5. Watch request records to confirm no traffic uses the old key.

Common states

State	Meaning
Enabled	Requests can be sent normally
Disabled	Requests are rejected, useful for temporary suspension
Deleted	The key is removed and cannot be restored
Insufficient permission	The key is valid but cannot access the target group or model

TIP

For production, split API Keys by project and environment. It makes billing, limits and abnormal traffic much easier to diagnose.