Skip to main content
The user management API is for automation scripts or private console integrations. For routine API key management, prefer API key management in the console.
The management API is authenticated separately from model-call APIs. Console calls use the active browser session; scripts need a management credential and the matching New-Api-User header. A model-call sk- API key cannot authenticate management API requests.

​
List API keys

Returns the API keys you can manage. The key field in list responses may be masked.

​
Create an API key

​
string
required
API key name. Use a client or task label such as claude-code, codex, or cherry-studio.
​
integer
Quota available to this API key. When unlimited_quota is true, this field does not cap the key.
​
integer
Unix timestamp. Use -1 for no expiration.
​
boolean
Whether the API key has no key-level quota cap. The account balance is still charged normally.
​
boolean
Whether to enable a model allowlist.
​
string
Model allowlist value when model limits are enabled.
​
string
Groups assigned to the API key. Use commas for multiple groups, for example codex,codex-passthrough.
​
boolean
Whether to allow retrying across groups. This is usually used with auto or multi-group API keys.
​
string
Source IP allowlist for this API key. Leave empty for no IP restriction.

​
Get an API key

​
integer
required
API key ID.

​
Copy the full API key value

Returns the full value for one of your own API keys. Call this only from a trusted environment, and do not expose the result to page scripts, logs, or untrusted systems.

​
Update an API key

Use the same fields as API key creation and include the target API key ID. For enable/disable-only changes, use status_only.

​
Delete an API key

After deletion, the API key can no longer call model APIs. In-flight requests may not be interrupted immediately.

​
Search API keys

​
string
Search by API key name.

​
Boundaries

  • Manage only your own API keys.
  • Do not infer admin endpoints from this user-facing management API.
  • Automation scripts should handle expired sessions, 403 permission errors, and 429 rate limits.