API Keys

Path: Console → API Keys /console/token

What it does

Create, view, edit, and delete your API keys (sk--prefixed strings) for programmatic access to primerouter.

Create a token

Field	Required	Description
Name	✓	Local identifier (e.g. cursor-prod)
Expiry	—	Empty = never expires
Quota	—	Empty = use account balance; otherwise cap this token's spend
Model restriction	—	Multi-select; only chosen models may be called
IP allowlist	—	Restrict by IP / CIDR
Group	—	Selects pricing multiplier (see Groups)
Cross-group retry	—	When current group has no available channel, may auto-retry across groups (recommended ✓)

⚠️ The full key is shown only once after save. Copy and store it — you'll have to recreate if lost.

Edit / enable / disable

• Edit: every field except the key itself
• Disable: pause without deleting; calls return 401
• Reset usage: clear the cumulative spend counter — useful for new billing windows
• Delete: irreversible

Filter and sort

By name, status, creation time, last-used. Each row shows:

• Name, status (active / disabled / expired)
• Used / total quota
• Last call time
• Actions (copy, edit, disable, delete)

Security recommendations

1. Use a dedicated key per project — easier auditing and rotation
2. Set IP allowlist for production — limits damage if leaked
3. Set an expiry — 90 / 180 day rolling rotation
4. Monitor usage — filter logs by token; disable on anomalies

FAQ

Q: Token allows qwen-max, but I called deepseek-chat. What happens? A: Returns 403 with a clear "model not allowed for this token" error.

Q: What does "cross-group retry" do? A: When your group has no usable channel for the requested model, primerouter will try other groups' channels. Enable for higher availability; disable to strictly enforce cost source.