Key management API

The key management API lets your own systems, for example an ERP, create, change and revoke the Inference API keys of your account. A typical setup uses one Inference API key per end customer. Every key you create this way belongs to your account, and its requests are paid from your prepaid credit balance like any other key.

Deutsche Version

1. Create a management key

The key management API uses its own key type, the management key (llmbase_mk_…). You create it only in the dashboard, under API Keys → Management keys.

• If the Management keys section does not appear in your dashboard, contact support.
• The secret is shown exactly once, right after you create the key. Store it like a password.
• An account can have up to 5 active management keys.
• A management key can call only /v1/keys. It cannot run inference: a request to /v1/chat/completions with a management key returns 403. Inference API keys cannot call /v1/keys (403 management_key_required).
• Revoke a management key in the dashboard. The next request with it returns 401 api_key_disabled.

Send the management key as a bearer token:

curl https://api.llmbase.ai/v1/keys \
  -H "Authorization: Bearer $LLMBASE_MANAGEMENT_KEY"

2. Endpoints

Method	Path	Success	Description
POST	/v1/keys	201	Create an Inference API key. The response contains the secret, only here.
GET	/v1/keys	200	List the account’s Inference API keys, without secrets.
GET	/v1/keys/{id}	200	Read one key.
PATCH	/v1/keys/{id}	200	Change name, limits, end_customer_ref or disabled.
DELETE	/v1/keys/{id}	200	Revoke a key. Repeating the call also returns 200.

The list contains every Inference API key of the account, including keys created in the dashboard. Management keys never appear in it.

Create a key

curl https://api.llmbase.ai/v1/keys \
  -H "Authorization: Bearer $LLMBASE_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Customer 4711",
    "end_customer_ref": "ERP-4711",
    "monthly_limit_usd_cents": 50000,
    "daily_limit_usd_cents": 5000
  }'

Field	Type	Required	Description
name	string	yes	1 to 100 characters.
monthly_limit_usd_cents	integer or null	no	Credit limit per UTC calendar month, in USD cents.
daily_limit_usd_cents	integer or null	no	Credit limit per UTC day, in USD cents.
end_customer_ref	string or null	no	Your own reference, 1 to 128 characters, unique among the account’s keys that are not revoked.

The 201 response is the key object plus "secret": "llmbase_…". The secret is not stored in readable form and is never returned again.

Key object

{
  "id": "key_3f…",
  "object": "api_key",
  "name": "Customer 4711",
  "end_customer_ref": "ERP-4711",
  "token_prefix": "llmbase_ab12cd",
  "monthly_limit_usd_cents": 50000,
  "daily_limit_usd_cents": 5000,
  "status": "active",
  "created_at": 1762689600,
  "usage": {
    "month": "2026-11",
    "month_spent_usd_cents": 1234,
    "day": "2026-11-09",
    "day_spent_usd_cents": 210
  }
}

• status is active, disabled or revoked.
• created_at is a Unix timestamp in seconds.
• usage comes from the key’s limit check. It is null for a key without any limit. month_spent_usd_cents is reported once any limit is set, day_spent_usd_cents only while a daily limit is set; otherwise it is null. Spending counts from the moment the first limit was set.

Change, disable or revoke a key

curl -X PATCH https://api.llmbase.ai/v1/keys/key_3f… \
  -H "Authorization: Bearer $LLMBASE_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"daily_limit_usd_cents": null, "disabled": false}'

• PATCH accepts name, monthly_limit_usd_cents, daily_limit_usd_cents, end_customer_ref and disabled. A missing field stays unchanged; null removes a limit.
• disabled: true blocks a key, disabled: false enables it again.
• DELETE revokes a key for good. A revoked key cannot be enabled or changed again (409 api_key_revoked). Keys revoked in the dashboard are revoked in the same way.
• Changes apply from the next request. Requests that are already running, including streams, finish and are billed normally.

3. Limits are optional

Both limits are optional. A missing limit or null means the key has no limit in that period; it is then limited only by your credit balance and the existing rate limits. A limit you set must be an integer from 1 to 1000000 USD cents (USD 10,000); 0, negative values, decimals and strings return 400 invalid_limit. Both limits apply; whichever is reached first blocks new requests: 402 api_key_spend_cap_exceeded for the monthly limit, 429 api_key_daily_cap_exceeded for the daily limit (until 00:00 UTC).

Note: This key has no limit. We recommend setting a monthly and daily limit. Credit consumed through leaked, compromised or misused keys is not refunded.

The dashboard shows the same note for every key without any limit.

4. Pagination

GET /v1/keys returns the newest keys first:

{ "object": "list", "data": [ … ], "has_more": true, "next_cursor": "…" }

• limit: 1 to 100 keys per page, default 100.
• cursor: pass next_cursor from the previous page to read the next one. The cursor is opaque; do not build it yourself.

5. Limits of the API

• Rate limit: 60 requests per minute per management key. Above that, the API returns 429 rate_limited with Retry-After: 60.
• Number of keys: up to 500 Inference API keys per account that are not revoked. Above that, POST returns 409 api_key_count_limit_reached.
• Management keys: up to 5 active management keys per account.

6. Retries and lost responses

Set end_customer_ref to make a retried POST safe. A second key with the same end_customer_ref is not created; the API returns 409 end_customer_ref_taken with the api_key_id of the existing key.

If your system lost the 201 response, the secret is gone. Revoke the key with the api_key_id from the 409 and create a new one. Without end_customer_ref, find the key with GET /v1/keys by name and created_at.

7. If a management key is compromised

Revoking a management key stops only the management key itself. Inference API keys it created keep working, and their secrets may be known to whoever had the management key.

1. Revoke the management key in the dashboard.
2. Revoke every Inference API key it created, with DELETE /v1/keys/{id} from a new management key or in the dashboard.
3. If you cannot tell which keys it created, contact support.

8. Errors

Errors use the same format as the rest of the API. param is set only for 400 responses; the request ID is in the x-llmbase-request-id header.

{
  "error": {
    "message": "monthly_limit_usd_cents must be null or an integer between 1 and 1000000.",
    "type": "invalid_request_error",
    "param": "monthly_limit_usd_cents",
    "code": "invalid_limit"
  }
}

HTTP	code	Meaning
400	invalid_limit	A limit is not null or an integer from 1 to 1000000.
400	invalid_request	Invalid JSON, unknown field, invalid name or invalid cursor.
401	missing_api_key, invalid_api_key, api_key_disabled	No key, unknown key, or revoked management key.
403	management_key_required	An Inference API key called /v1/keys.
403	key_management_not_enabled	Key management has been disabled for this account.
404	api_key_not_found	No key with this ID in your account.
409	api_key_revoked	The key is revoked and cannot be changed.
409	api_key_count_limit_reached	The account reached its maximum number of keys.
409	end_customer_ref_taken	Another key that is not revoked uses this end_customer_ref; see api_key_id.
429	rate_limited	More than 60 requests per minute with this management key.