API keys authenticate requests from your applications and services. Each key is scoped to your organization тАФ all API calls made with a key create and access resources within that organization.

тАЛ
Credits

An API key authenticates you; it does not grant unmetered use. Requests that run a model тАФ BRAHMA chat, embeddings, moderation and deep research, VAANI speech, LIPI transcription, the Voice Engine, and knowledge-base ingestion and search тАФ draw on your organizationтАЩs credit balance, and are refused with 402 once it is exhausted or the daily spend cap is reached. Read-only calls (listing models, reading history, checking usage) are never charged. Calls that run on your own provider keys cost nothing and are never gated.

тАЛ
Best practices

  • Use one key per environment тАФ separate keys for development, staging, and production make rotation easy and limit blast radius if a key is compromised.
  • Use one key per service тАФ this allows you to revoke a single serviceтАЩs access without affecting others.
  • Rotate keys regularly тАФ create a new key, update your secret store, then archive the old key.
  • Never hardcode keys тАФ use environment variables or a secrets manager. Never commit keys to version control.
  • Monitor last_used_at тАФ keys with no recent activity may be safe to archive.