API Key Management

An API key is your credential for calling the API. Every request to /v1/... must include:

Authorization: Bearer sk-xxxxxxxx

Menu location: General → API Keys in the left sidebar.

Creating a key

Click New at the top right of the list. The form has three sections: basic information, quota settings and advanced settings. Only the name is required — everything else works at its defaults.

Basic information

Quota settings

Advanced settings

After creation, copy and store the sk- key immediately.

Supplier routing

The same model is usually served by several upstream routes. The interface calls these suppliers. Supplier routing decides which route your request takes, which affects price, speed and success rate.

There are two modes.

Smart routing (default, recommended)

The platform automatically picks the best available supplier, with a circuit breaker — failing routes are dropped automatically, with no action from you.

You can express a preference:

You can also set ignored suppliers to exclude specific routes while letting the system choose among the rest.

Specify suppliers

Manually define a supplier call order. Requests try each in the order you set.

Combine this with the cross-supplier retry switch: when enabled, if every channel in the current supplier fails, the next supplier in order is tried; when disabled, only the first is used and failure returns an error.

Image settings

These two settings only apply to image-generation models.

Image response format:

Image storage strategy (available when the format is Force URL):

Managing existing keys

Each row in the key list supports:

• View usage — cumulative spend and call count for that key;
• Edit — change any field above (the key value itself never changes);
• Disable / Enable — pause without altering configuration;
• Delete — permanent and irreversible.

Select multiple rows to disable or delete in bulk.

Key statuses

Using keys in code

The platform is OpenAI-compatible; most SDKs need only two changes: base_url and api_key.

curl https://<your-site-domain>/v1/chat/completions \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-5.5", "messages": [{"role": "user", "content": "Hello"}]}'

from openai import OpenAI

client = OpenAI(
    api_key="sk-xxxxxxxx",
    base_url="https://<your-site-domain>/v1",
)

resp = client.chat.completions.create(
    model="gpt-5.5",
    messages=[{"role": "user", "content": "Hello"}],
)
print(resp.choices[0].message.content)

import OpenAI from 'openai'

const client = new OpenAI({
  apiKey: process.env.API_KEY,
  baseURL: 'https://<your-site-domain>/v1',
})

const resp = await client.chat.completions.create({
  model: 'gpt-5.5',
  messages: [{ role: 'user', content: 'Hello' }],
})
console.log(resp.choices[0].message.content)

The base URL is simply the site domain you are using — no api. prefix. See the API Reference for full parameters and additional endpoints.

Security practices

1. One key per purpose — separate keys for production, testing and each colleague. When something goes wrong you can pinpoint and revoke precisely.
2. Use environment variables — keys should never appear in source code, config files, frontend bundles or screenshots.
3. Cap external keys — for contractors and trials, turn off unlimited quota and set an amount you can afford to lose.
4. Lock down IPs where you can — for server-side calls, an IP whitelist is the cheapest protection against leaks.
5. Review logs regularly — filter usage logs by key; an unusual spike is the earliest signal of a leak.

Related