API keys

Create, name, scope and revoke keys per project.

Keys belong to a project. Create them under API keys: choose a name and scopes. The full key is displayed once.

Revoke a key at any time; the gateway stops accepting it within a second across all instances.
Last used is tracked per key so you can spot unused or leaked keys.
Rate limits are applied per key (Rate limits).

If a key leaks, revoke it and create a new one. Usage under the old key stays visible in your history.

Expiry and IP allowlist

Each key can carry two restrictions, set when you create it or later from its row under API keys:

Expiry — the key stops working at the end of the chosen day (India Standard Time). Requests with an expired key get 401 invalid_api_key naming when it expired.
Allowed IPs — up to 50 addresses or CIDR ranges, IPv4 or IPv6 (for example 203.0.113.7, 203.0.113.0/24, 2001:db8::/32). A request from any other address gets 403 ip_not_allowed, so a leaked key is useless outside your network.

Both are checked on every request and take effect within a second of saving. Spend caps per key are described under Credits & billing.