Workspaces & Sub-accounts
Group keys by project, give team members their own logins, and cap spend per project.
If you are the only person using this account, skip this chapter — the default workspace is all you need.
Workspaces and sub-accounts help once any of the following is true:
- Several projects share one account and you want to know how much each project spent;
- Multiple people are on the team and you would rather not share one set of credentials;
- You want a per-project cap so one runaway job cannot burn through the whole budget.
Menu location: avatar menu → Team settings in the top right, which has a Workspaces and a Sub-accounts tab. Switching between key groups happens directly on General → API Keys in the left sidebar.
Four concepts
| Concept | What it is |
|---|---|
| Workspace | A container for API keys. Each one tracks usage separately and can carry its own periodic cap |
| Default workspace | Created with your account. Cannot be deleted, and cannot be granted to sub-accounts |
| Main account | The account you registered. Only it can create workspaces, manage sub-accounts and configure quota |
| Sub-account | A separate login the main account opens for a team member; it spends the main account's quota |
A sub-account is not a separate billing account. It has no wallet of its own — every call is charged to the main account, so there is no need to fund each member individually.
Workspaces
The API Keys page is already organised by workspace: the workspace list on the left, the keys of the selected workspace on the right. Whichever workspace a key is created in is where its usage is attributed.
Create and edit
Click new in the workspace list and give it a name plus an optional description. Existing workspaces can be renamed, re-described or deleted from their Settings.
Periodic quota cap
Open a workspace's Settings → Quota management to give it its own spending cap:
| Period | Behaviour |
|---|---|
| Daily | Resets once per day |
| Weekly | Resets once per week |
| Monthly | Resets once per month |
The reset is automatic, and you can also reset immediately at any time. Once the combined spend of every key in that workspace reaches the cap, its calls stop — other workspaces are unaffected.
This is a per-workspace guardrail, not your account balance. If the account balance runs out, every workspace stops regardless of this setting. Individual keys carry their own quota limit too, and the strictest of the three applies.
Sub-accounts
Create
On the Sub-accounts tab, click create and fill in:
| Field | Notes |
|---|---|
| Username | Used to sign in, unique across the platform, cannot be changed later |
| Display name | Shown in the list — a person's name or role works well |
| Optional | |
| Temporary password | 8–20 characters. You can require a change on first sign-in |
| Initial workspaces | Which workspaces this account starts with; adjustable at any time |
A single main account can create up to 100 sub-accounts.
Access scope
A sub-account only sees the keys and usage inside the workspaces it has been granted — your other projects stay invisible. Two equivalent ways to adjust that:
- Edit the account's workspace list on the Sub-accounts tab;
- Add or remove members under a workspace's Settings → Workspace members.
Permission boundaries
| Action | Main account | Sub-account |
|---|---|---|
| Create and use keys in granted workspaces | ✅ | ✅ |
| View usage for granted workspaces | ✅ | ✅ |
| Create / delete workspaces | ✅ | ❌ |
| Configure workspace quota caps | ✅ | ❌ |
| Create / disable / delete sub-accounts | ✅ | ❌ |
| Top up, view account balance | ✅ | ❌ |
A signed-in sub-account gets a trimmed console — overview, API keys, usage logs and profile — with no Team settings entry.
Disable, reset password, delete
From the actions menu in the sub-account list you can:
- Reset password — generate a new temporary password to hand over;
- Disable — block sign-in immediately while keeping the account and its history, reversible at any time;
- Delete — remove the account.
When someone leaves, rotate their keys
This is the step people miss most often.
The sub-account list has a column showing how many keys each account created itself. Note carefully:
Revoking workspace access, disabling the account, even deleting it — none of these invalidate the keys it created. Those keys keep working, and keep spending the main account's money.
The correct order is:
- Check how many keys that sub-account created, in the sub-account list;
- Find those keys in the relevant workspaces and delete or regenerate them;
- Then disable or delete the sub-account.
Step 3 on its own is not enough.
FAQ
Do sub-accounts need their own top-ups? No. A sub-account has no wallet; all spend comes out of the main account balance.
Can I share the default workspace with a sub-account? No. The default workspace usually holds the global keys created early in an account's life, so the system blocks granting it. Create a new workspace for team members instead.
What happens when a workspace cap is reached? Keys in that workspace stop and return an insufficient-quota error; other workspaces carry on. It recovers automatically at the next period, or you can reset it immediately.
A sub-account forgot its password. The main account resets it from the sub-account list, producing a new temporary password. Sub-accounts cannot recover passwords themselves.
What happens to keys inside a deleted workspace? The default workspace cannot be deleted. Before deleting any other workspace, deal with the keys inside it so no usable credentials are left behind.