Manage
API keys
How to authenticate requests, the limits a key can carry, and how to create, rotate and revoke keys.
Authenticating requests
Send your key as a bearer token on every request:
Authorization: Bearer sk_p9_…A key is shown once, when you create it, and is never shown again. If you lose one, revoke it and create another.
One key per integration
Usage and cost are recorded per key. Give each service, environment and experiment its own key, named for what it does (checkout-summariser-prod, evals-nightly): you can then see its spend on its own line, cap it, and revoke it without touching anything else.
Keys belong to a project in your organisation, and a key's name must be unique within its project.
Limits
Set limits when you create a key. Expiry, credit cap and rate limit can be changed later; allowed models are fixed at creation.
| Limit | What happens |
|---|---|
| Expiry | After it, the key answers 401 (api_key_expired). |
| Credit cap | A lifetime spending limit for this key alone, in rupees. A request the cap can't cover answers 402. |
| Allowed models | Requests for any other model answer 403 (model_not_allowed). |
| Rate limit | Requests per minute; 60 unless you choose otherwise. Past it, 429 (rate_limited_key) with a Retry-After header. |
| Environment | A label (production, development or testing) for your own filtering. |
Creating a key
In the dashboard, API keys → Create key. From code, use the Account API's POST /api/keys.
Rotating a key
- Create a new key with the same project, limits and allowed models.
- Deploy it.
- Revoke the old key once the request logs show no more traffic on it (filter by key).
Revoking a key
Revoke from the dashboard or with DELETE /api/keys/{key_id}. The key stops working within seconds, and the revocation is recorded in your organisation's activity log.
Keeping keys safe
- Keep keys in environment variables or a secrets manager, never in source code or in a browser app. Call Paranine from your backend.
- Give each deployment its own key, with a credit cap sized to what it should ever spend.
- Set allowed models on keys that need only one model, so a leaked key can't run up a bill on a pricier one.
Something unclear or wrong on this page? Tell us. Machine-readable copies: llms.txt.