API Keys

The API Keys page is the main place to create, secure, and operate the keys your apps use to authenticate with LLM Gateway.

Use this page to:

• Create project-specific API keys
• Set all-time and recurring spend limits per key
• Set an expiration (TTL) so a key disables itself automatically
• Track usage for each key, including the active recurring window
• Rename keys and enable or disable them without deleting them
• Roll a key's secret in place if it may have leaked
• Configure IAM rules for model, provider, and pricing access

Creating an API Key

Click Create API Key and configure:

• Name: A label such as production, staging, or ci
• Expiration (TTL): An optional time-to-live after which the key disables itself
• All-time usage limit: An optional lifetime spend cap for the key
• Recurring usage limit: An optional spend cap that resets on a schedule

Recurring limits support:

• Minimum window: 1 hour
• Maximum window: 12 months
• Units: hour, day, week, or month

This is useful when you want a key to stay below a fixed budget per hour, day, week, or month, while still keeping a separate lifetime cap if needed.

Expiration (TTL)

Turn on Set expiration (TTL) when creating a key to give it a limited lifetime. Choose a value and a unit — minutes, hours, or days — and the key is disabled automatically once that time passes. Leave it off for a key that never expires.

Expired keys show an Expired indicator in the list and move to the Inactive tab. To use one again, reactivate it and pick a new future expiration:

• Activate an expired key and you'll be prompted to set a fresh TTL before it comes back online
• Keys with no TTL, or whose TTL is still in the future, can be enabled and disabled without setting a new expiration

This makes TTL keys ideal for temporary access — short-lived demos, CI runs, or contractor keys that should not linger.

Usage Limits

Each API key can enforce two independent limit types:

Examples:

• $50 all-time for a temporary integration key
• $10 / 1 day for a development key
• $500 / 1 month for a production service key

If a key hits either limit, requests using that key are rejected until the key is updated or, for recurring limits, the next window begins.

Low-spend active keys without a limit get a suggested cap you can apply in one click.

How recurring windows work

Recurring usage is tracked separately from total lifetime usage.

• The dashboard shows the key's Current Period usage
• The active window also shows when it resets
• When the configured window expires, usage for that window resets automatically
• Updating the recurring limit configuration resets the current window and starts a new one

Usage includes both LLM Gateway credits and requests routed through your own provider keys when applicable.

API Keys List

There are two API Keys pages:

• Project → API Keys lists the keys of the current project.
• Organization → API Keys lists the keys of every project in the organization in one table, with a Project column and filter. Only owners and admins can open it. Its Create API Key dialog asks which project the key belongs to.

Each key in the list shows:

The period selector next to the search box switches the Usage column between All time (the default), Last 24 hours, Last 7 days, Last 30 days, and Last 90 days. The choice is kept in the page URL. Limits and their gauges always measure against all-time and current-window spend, whatever period is selected. Period usage comes from hourly rollups, so the latest requests can take a few minutes to appear.

Unused key insights

An active key that has not served a request in 30 days gets an amber badge showing how long it has been idle (for example Unused 45d, or Never used); after 90 days the badge turns red. A key that has never been used counts from its creation date. A banner above the list counts these keys and offers Show unused (filters the list to them) and Select unused (selects them for a bulk deactivate). Unused keys are a leak risk, so deactivate the ones you no longer need.

Limit suggestions

An active key with no limits and low all-time spend shows a muted Suggest hint under its limits, for example Suggest $10/week. The suggested cap grows with the key's spend and is always at least twice its all-time spend, so it never blocks traffic the key has already served:

Click the hint, then Set, to apply the cap as the key's recurring limit; the confirmation offers Undo, which is skipped if the limit changed in the meantime, and you can change or remove the limit anytime. Keys that have spent $250 or more, expired keys, playground keys, keys flagged as unused, and keys whose creator has a capped member budget get no suggestion.

Selecting keys and bulk actions

Tick the checkbox on a row to select it. The list shows 50 keys per page, and the header checkbox selects only the keys on the current page. When the view has more keys than one page, a notice under the action bar says how many are selected and offers Select all N keys in this view, which selects every key that matches the current filters across all pages. Changing a filter, the search, or the period clears the selection.

With keys selected, the action bar offers Deactivate, Reactivate, and Delete. Each shows how many selected keys it applies to and asks for confirmation first:

• Deactivate skips keys that are already inactive.
• Reactivate skips keys that are already active, and keys whose expiration (TTL) has passed, which you reactivate one at a time with a new expiration. It stops once the organization reaches its active API key limit.
• Delete permanently deletes the keys.

Developers can only change keys they created. The managed Lounge key cannot be selected. A summary after each bulk action lists any keys that were skipped and why.

Every configured limit renders as a gauge, so a key's headroom is visible without opening it. A key is flagged approaching once usage reaches 80% of a limit and reached once usage meets it — the all-time limit stays blocked until it is raised or removed, while a recurring limit clears itself on its reset date.

Filters sit above the list:

• Status — active (default), inactive, or all
• Creator — keys you created, or everyone's (hidden for developers, who only ever see their own)
• Usage — narrow to just the keys approaching or at a limit, or unused
• Project — on the organization page, narrow to one project
• Search — match a key's name or masked preview

A filter that would leave the list empty resets itself, so you never land on a blank table.

Actions

The actions menu on each key offers:

• View Statistics: Open a dedicated analytics page for that key (see below)
• Manage IAM Rules: Restrict which models, providers, or pricing tiers the key can use
• Rename Key: Change the key's label without touching its secret or history
• Activate / Deactivate Key: Pause usage without deleting the key (reactivating an expired key prompts for a new expiration)
• Roll Key: Generate a new secret for the key and invalidate the old one (see below)
• Update limits: Change all-time or recurring limits
• Delete: Permanently remove the key

Rolling a Key

Roll Key replaces a key's secret while keeping the key itself. The name, usage history and statistics, all-time and recurring limits (including the current period window), IAM rules, and expiration all stay exactly as they were — only the secret changes.

This is the fastest fix when a secret leaks into a commit, a log, or a shared environment: you cut off the exposed value without recreating the key or losing its spend tracking.

1. Open the key's actions menu and choose Roll Key
2. Confirm in the dialog
3. Copy the new secret and update every client using the old one

Per-Key Statistics

The View Statistics action opens a dedicated page scoped to a single API key, so you can see exactly what that key is doing without filtering the whole project.

The page respects the shared date-range picker and shows:

• Summary cards — the key's cost, tokens, requests, and error rate for the selected range.
• Cost by Model — a horizontal bar chart ranking the key's models by cost, requests, or tokens.
• Cost by Model Over Time — a stacked area chart of the same metrics, with a Mappings / Canonical toggle.

These are the same breakdowns as the project Analytics page, narrowed to the one key — useful for confirming a key is healthy and spending on the models you expect.

IAM Rules

IAM rules let you narrow what an API key is allowed to access.

Supported rule types include:

• Allow/Deny models
• Allow/Deny providers
• Allow/Deny pricing
• Allow/Deny IP ranges (CIDR) — Enterprise plan only

Use IAM rules when you want a key to be valid, but only for a specific subset of models or providers. For a deeper explanation, see the API Keys & IAM Rules feature page.

Org admins can additionally set member-level IAM rules on the Team page. Those act as a ceiling for every key the member creates: key rules can only narrow access within them, never expand it. The IAM page shows a notice when organization-level restrictions apply to your keys.

Plan Limits

The page also shows how many API keys you are using relative to your plan allowance. The cap counts active keys across every project in the organization, so deactivated and deleted keys do not count against it.

• Free: 5 active keys
• Pro (legacy): 20 active keys
• Enterprise: 500 active keys

A custom per-organization limit set by LLM Gateway overrides these defaults — except for an Enterprise-plan organization whose Enterprise access has lapsed, which stays at 5 active keys.

Owners and admins can also set a per-member key cap on the Team page, which applies on top of the organization-wide allowance.

If you reach the limit, the Create API Key button is disabled until you delete or deactivate unused keys. Contact contact@llmgateway.io to raise the limit.