Key restrictions and spend caps
Limit what a key can do and spend.
Each API key can carry its own limits. Set them when you create the key on the dashboard's API keys page. Give each application or environment its own key, so a leaked or runaway key is contained.
The options
| Option | Values | Changeable later |
|---|---|---|
| Environment | Live or Test | No |
| Expires | Permanent, 90 days, 30 days or 24 hours | No |
| Residency | Global, or EU only | No |
| Model access | The whole catalog, or a chosen set of models | No |
| Allowed IP ranges | CIDR ranges, one per line or separated by commas. Blank allows any address | No |
| Monthly spend cap | A US dollar amount, at least $0.01. Blank means no cap | Yes |
A new key, and a change to its spend cap, take effect within a short time of saving, not instantly.
Environment
Use a Live key with https://api.opinference.com/v1. A key used against an environment it was
not issued for is refused with 401 unauthorized.
Expiry
An expired key is refused with 401 unauthorized and the message
the presented key was not accepted. Create a new key before the old one expires, then switch
over.
Residency
An EU only key is served only by EU-hosted endpoints, and its model list offers only models
with an EU-hosted endpoint. A request on an EU only key that asks for another region with
provider.region is refused with 400 policy_conflict. See
Provider preferences.
Model access
A key limited to a chosen set refuses any other model with 403 forbidden:
{
"error": {
"code": "forbidden",
"message": "model \"openai/gpt-oss-120b\" is not permitted for this key",
"kind": "terminal",
"scope": "request",
"type": "invalid_request_error"
}
}GET /v1/models with that key lists only the models it may use.
Allowed IP ranges
A request from an address outside the key's ranges is refused with 403 forbidden. Use ranges for
keys that run on servers with fixed addresses. Leave them blank for keys used from laptops or
changing addresses.
Monthly spend cap
The cap is counted over the UTC calendar month and resets at the start of the next one. A request
that would cross the cap is refused with 402 budget_exceeded.
Change or remove the cap at any time from the key's row on the API keys page.
The cap protects you from one key spending too much. It does not top up or stop other keys. The account's prepaid balance is the overall limit: see Credits and billing.
Summary of refusals
| Situation | Status | Code |
|---|---|---|
| Key expired, deleted or unknown | 401 | unauthorized |
| Key used against the wrong environment | 401 | unauthorized |
| Model not in the key's set | 403 | forbidden |
| Address outside the key's IP ranges | 403 | forbidden |
| Region outside the key's residency | 400 | policy_conflict |
| Monthly spend cap reached | 402 | budget_exceeded |
| Account out of credit | 402 | insufficient_credit |