Permissions

API key permissions let you restrict what each key can do. By default, a new key has full access to all resources in the workspace. You can narrow that access when creating a key via the Dashboard.

Permission types

Type	Controls
Model permissions	Which AI models the key can use for completions, embeddings, and images
Folder permissions	Which document folders the key can list, read, and search (enterprise)
Custom GPT permissions	Which Custom GPTs the key can list and use (enterprise)
Spending limit	Maximum monthly spend for the key

Empty-list semantics

The meaning of an empty list differs by resource type:

• Models — an empty (or omitted) modelIds means the key can use all models. Add at least one ID to restrict it to those models.
• Document folders & Custom GPTs — governed by a separate restrictDocumentFolders / restrictCustomGpts flag, which defaults to on (restricted). While the flag is on, an empty list means no access. Turn the flag off (restricted: false) to grant access to all folders / Custom GPTs regardless of the list.

Configuring permissions

Permissions are configured via the Dashboard → API Keys page. When creating or editing a key, you can set model restrictions, folder restrictions, Custom GPT restrictions, spending limits, and admin scopes.

To read back the current permissions and spending limits for all your keys, use GET /v2/apiKeys.

Spending limits

Spending limits use microcents (1 EUR = 100,000,000 microcents). This provides high precision for per-request cost tracking.

EUR amount	Microcents
0.01 EUR	1,000,000
1.00 EUR	100,000,000
50.00 EUR	5,000,000,000

The GET /v2/apiKeys response includes both monthlySpendingLimit and currentMonthSpend for each key.

System keys vs user keys

• User keys are created via the dashboard. Their permissions can be managed there.
• System keys are automatically generated for internal use. Their permissions cannot be modified.

Admin scopes

The adminScopes field controls access to admin-only endpoints. Set scopes when creating a key via the Dashboard:

Scope	Grants access to	Available for
admin:export_usage	Usage analytics endpoints	All workspaces
admin:export_audit_logs	Audit log export endpoints	Enterprise only

Only workspace admins (or B2C workspace owners) can create keys with admin scopes.

Enterprise features

Document folder permissions, Custom GPT permissions, and audit log export require an enterprise workspace. These restrictions are only available for enterprise workspaces.