deeprelayDocs
CH·02CLI reference

deeprelay api-keys

Create and manage API keys with budgets, model allowlists and rate limits

Create and manage API keys with budgets, model allowlists and rate limits

Synopsis

Create and manage the API keys your tools and applications use, with per-key limits:

  • Monthly budget — a dollar cap on what the key may charge to your balance each billing month. Usage covered by your plan does not count. When the budget is reached, requests with that key are refused (status rejected, error code naming the budget) until the next billing month. You get an alert at 80% and 100%.
  • Model allowlist — the only models the key may call. A model that later leaves the catalog stays on the list, marked (stale), until you remove it.
  • Rate limit — requests per second and burst size.
  • Expiry — a date after which the key stops working.

Who can manage keys. Creating, changing and revoking keys needs the keys:manage capability. A full_access key has it; a standard key does not unless it was granted at creation with --manage-keys. The CLI itself manages keys with the login key deeprelay login stored, so these commands work right after you log in. The keys deeprelay setup writes into tool and editor configs never carry keys:manage. Never give keys:manage to a key used by a tool: anything holding it can mint more keys.

Limits only narrow. A new key's scopes, budget, allowlist, rate limit and expiry must each fit inside those of the key creating it, and an update can never widen a key past its creator's limits. A key's scopes are fixed when it is created.

Admins see every key in the organization; members see the keys they created. The key itself is shown once, by deeprelay api-keys create, and never again.

deeprelay api-keys [command]

Options

  -h, --help   help for api-keys

Options inherited from parent commands

      --api-base string   API base URL (override with DEEPRELAY_API_BASE env) (default "https://api.deeprelay.ai/v1")
      --debug             Enable debug logging to stderr
      --no-preflight      Skip the plan/credit check before inference requests (override with DEEPRELAY_NO_PREFLIGHT env)
  -o, --output string     Output format: table|json (default table on TTY, json otherwise) (default "table")

SEE ALSO

← The deeprelay CLI