Create and rotate API keys

Give each project and environment a scoped credential, preserve attribution, and rotate access without downtime.

Why separate keys

A key belongs to a project, and the project identifies a test or live environment. Separate keys reduce blast radius, make usage attributable, and allow one workload to rotate without interrupting others.

Create a key

1. Select the owning project.
2. Use a name that identifies workload and environment, such as production-router.
3. Select Create API key.
4. Copy the full secret immediately. Later, Live data shows only the public prefix and last four characters.

Handle the secret

• Store it in a secret manager, never in source control or a client-side bundle.
• Inject it as ALLM_API_KEY on the server or in CI.
• Use the prefix and last-used timestamp to identify credentials during audits.

Rotate safely

1. Create the replacement key before revoking anything.
2. Deploy the replacement to every consumer.
3. Confirm successful API traffic and updated last_used_at.
4. Revoke the previous key. Revocation takes effect immediately.

Scopes and limits

Keys created in the app currently receive catalog:read, changes:read, pricing:calculate, and decisions:write. Creation and revocation require an owner, admin, or developer role. Limits are 2 active keys on Free, 10 on Pro, and 50 on Business.