API Key Management

An API key is your credential for calling the API. Every request to /v1/... must include:

Authorization: Bearer sk-xxxxxxxx

Menu location: General → API Keys in the left sidebar.

Creating a key

Click New at the top right of the list. The form has three sections: basic information, quota settings and advanced settings. Enter a name and confirm that the selected routing strategy or supplier is authorized for your account.

Basic information

Quota settings

Advanced settings

After creation, copy and store the sk- key immediately.

Supplier routing

The same model is usually served by several upstream routes. The interface calls these suppliers. Supplier routing decides which route your request takes, which affects price, speed and success rate.

There are two modes.

Smart routing (default, recommended)

The platform selects among suppliers that are currently authorized for your account, registered in a supply pool, support the requested model, and meet health requirements. Health checks and circuit breakers restrict failing routes. Automatic routing does not grant access to suppliers outside your permissions. An authorized source outside the pools does not automatically become a candidate.

You can express a preference:

The Chinese interface shows these as 稳定优先（企业版） and 价格优先（特价版）. The display names emphasize reliability and cost preferences; the internal strategy values remain success_first and price_first.

Get started in three steps:

1. Open General → API Keys in the sidebar.
2. Edit an existing key or click New.
3. Under Supplier routing → Smart routing, select an authorized strategy and save. Existing keys do not need to be recreated, and their strings in your clients remain unchanged.

These names describe routing preferences, not a uniform price or fixed package discount. Applicable source pricing and your existing membership or reseller pricing still determine charges. See Billing & Reconciliation.

An unauthorized strategy is shown as unavailable. An account with access only to the price pool can use Cost Effective. If neither pool is authorized, automatic requests are rejected; ask your site administrator to review access.

You can also set ignored suppliers to exclude specific routes while letting the system choose among the rest. Requests fail if no eligible route remains.

Specify suppliers

Manually define a supplier call order. Requests try available suppliers in that order, subject to current permissions. This automatic-routing upgrade preserves explicitly selected suppliers and their order.

Combine this with the cross-supplier retry switch: when enabled, if every channel in the current supplier fails, the next supplier in order is tried; when disabled, only the first is used and failure returns an error.

To pin a supplier, switch to Specify suppliers, keep only that authorized supplier, and turn off cross-supplier retry. This pins the supplier group, which may contain multiple routes; success still depends on its current model support and availability.

Compatibility with existing keys

You do not need to create a new API key or replace the key string in your clients. The upgrade changes how legacy automatic strategies are resolved when a request runs.

Editing an existing key's name, quota, or other metadata does not rotate its key string. Switching to a new automatic strategy requires an authorized Fast & Stable or Cost Effective option.

An unchanged key string does not mean identical model coverage in automatic mode. If a model was previously available only through a source outside the pools, automatic requests may return 503 after the upgrade. If you still have access to that specific supplier group, edit the existing key to select it manually, or ask an administrator to assess pool membership and source listing. Those configuration changes require a separate review; the upgrade does not guarantee they have been completed.

Distinguish routing permission denial (403) from no eligible model route in the pools (503). See Troubleshooting.

Image settings

These two settings only apply to image-generation models.

Image response format:

Image storage strategy (available when the format is Force URL):

Managing existing keys

Each row in the key list supports:

• View usage — cumulative spend and call count for that key;
• Edit — change any field above (the key value itself never changes);
• Disable / Enable — pause without altering configuration;
• Delete — permanent and irreversible.

Select multiple rows to disable or delete in bulk.

Key statuses

Using keys in code

The platform is OpenAI-compatible; most SDKs need only two changes: base_url and api_key.

curl https://<your-site-domain>/v1/chat/completions \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-5.5", "messages": [{"role": "user", "content": "Hello"}]}'

from openai import OpenAI

client = OpenAI(
    api_key="sk-xxxxxxxx",
    base_url="https://<your-site-domain>/v1",
)

resp = client.chat.completions.create(
    model="gpt-5.5",
    messages=[{"role": "user", "content": "Hello"}],
)
print(resp.choices[0].message.content)

import OpenAI from 'openai'

const client = new OpenAI({
  apiKey: process.env.API_KEY,
  baseURL: 'https://<your-site-domain>/v1',
})

const resp = await client.chat.completions.create({
  model: 'gpt-5.5',
  messages: [{ role: 'user', content: 'Hello' }],
})
console.log(resp.choices[0].message.content)

The base URL is simply the site domain you are using — no api. prefix. See the API Reference for full parameters and additional endpoints.

Security practices

1. One key per purpose — separate keys for production, testing and each colleague. When something goes wrong you can pinpoint and revoke precisely.
2. Use environment variables — keys should never appear in source code, config files, frontend bundles or screenshots.
3. Cap external keys — for contractors and trials, turn off unlimited quota and set an amount you can afford to lose.
4. Lock down IPs where you can — for server-side calls, an IP whitelist is the cheapest protection against leaks.
5. Review logs regularly — filter usage logs by key; an unusual spike is the earliest signal of a leak.

Related