API Keys¶
API keys are your credentials for the ModuCompia AI API. Manage them on the API Keys page of the dashboard.
Creating a Key¶
- Open API Keys in the left sidebar
- Create a key and configure:
- Name — descriptive label, max 50 characters (e.g. "Production App")
- Quota — optional spend limit in credits, or unlimited
- Model access — optionally restrict the key to specific models
- Expiration — optional expiry date; leave empty for a key that never expires
- IP allow-list — optional IP addresses / CIDR ranges allowed to use the key
- Group — optional rate/price group; your account's group is used when empty
- Copy the generated key — it starts with
sk-
Key Properties¶
| Property | Description |
|---|---|
| Name | Human-readable label |
| Key | The sk-… value, masked in listings |
| Status | Enabled / Disabled / Expired / Exhausted |
| Quota | Remaining and used credits for this key |
| Created | Creation timestamp |
| Expires | Expiry date, or never |
| Models | Allowed models, if restricted |
| IPs | Allowed addresses, if restricted |
Managing Keys¶
Reveal an existing key¶
Listings mask the key, but the full value can be revealed again from the API Keys page — individually or for several keys at once. This action is rate limited; it exists for recovery, not for automation.
Disable / Enable¶
Toggle a key's status without deleting it. Disabled keys immediately reject all API requests with 401.
Edit quota¶
Change a key's quota at any time. A key whose quota ran out becomes Exhausted and starts rejecting requests with 401; raising its quota or switching it to unlimited brings it back.
Delete¶
Permanently remove a key. Applications using it lose access immediately.
Where a Key Works¶
A key works only on the site it was created on. Sending it to a different host returns 403 this API key is not valid on this domain. Prices belong to the site you call, so a key issued elsewhere would not carry this site's prices either — create your keys on the site whose API you intend to use. See Authentication for the full error table.
Best Practices¶
- One key per application — makes usage easy to track and access easy to revoke
- Set quotas — prevent unexpected spend from bugs or abuse
- Restrict by IP — for server-side integrations with stable egress addresses
- Rotate regularly — delete old keys and create new ones periodically
- Never share keys — treat them like passwords; don't commit them to git or embed them in client-side code