API keys authenticate your requests to the Platform API. Each key belongs to a workspace and inherits that workspace's credit balance.
Creating a key
Go to Dashboard → API Keys and click New API Key. Enter a name that describes what the key is used for (e.g. backend-production, data-pipeline, dev).
After creation, the full key is displayed once. Copy it immediately and store it in a secrets manager or environment variable. The key cannot be retrieved again.
If you lose an API key, create a replacement and archive the old one. There is no way to recover a lost key.
Using a key
Include the key as a Bearer token in the Authorization header of every request:
POST /platform-api/api/v2/chat/completions
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json
Key states
| State | Effect |
|---|---|
| Active | Key is valid and can be used |
| Inactive | Key exists but requests return 401 Unauthorized |
| Archived | Key is permanently disabled and hidden from the list |
You can change a key's state from the dashboard. Deactivating a key is useful when you want to temporarily suspend access without deleting the key entirely. Archive a key when you no longer need it.
Permissions & restrictions
API keys can be restricted to specific models, document folders, and Custom GPTs. You can also set a monthly spending limit to cap usage.
- Model permissions — restrict which models a key can use
- Folder permissions — restrict which document folders a key can access (enterprise)
- Custom GPT permissions — restrict which Custom GPTs a key can use (enterprise)
- Spending limits — cap monthly spend in microcents
- Admin scopes — grant access to admin endpoints like usage export (
admin:export_usage, all workspaces) or audit log export (admin:export_audit_logs, enterprise only)
Permissions and spending limits are configured from the Dashboard → API Keys page. Use GET /v2/apiKeys to read back all keys with their current permissions and spending. See the Permissions guide for details.
Viewing usage per key
The Dashboard → Usage page breaks down spending and token usage by API key, so you can see which integrations are consuming the most credits.
Security recommendations
- One key per application — use separate keys for each service or environment so you can revoke individual access without affecting others
- Never commit keys to source control — store them in environment variables or a secrets manager
- Rotate regularly — create a new key, update your application, then archive the old key
- Monitor usage — check the usage dashboard regularly for unexpected spikes