> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aiohub.org/llms.txt
> Use this file to discover all available pages before exploring further.

# API key management

> Manage your own API keys through the user management API.

The user management API is for automation scripts or private console integrations. For routine API key management, prefer [API key management](https://api.aiohub.org/console/token) in the console.

<Note>The management API is authenticated separately from model-call APIs. Console calls use the active browser session; scripts need a management credential and the matching `New-Api-User` header. A model-call `sk-` API key cannot authenticate management API requests.</Note>

## List API keys

```text theme={"system"}
GET /api/token/
```

Returns the API keys you can manage. The `key` field in list responses may be masked.

## Create an API key

```text theme={"system"}
POST /api/token/
```

```json theme={"system"}
{
  "name": "codex",
  "remain_quota": 0,
  "expired_time": -1,
  "unlimited_quota": true,
  "model_limits_enabled": false,
  "model_limits": "",
  "group": "auto",
  "cross_group_retry": true,
  "allow_ips": ""
}
```

<ParamField path="name" type="string" required>
  API key name. Use a client or task label such as `claude-code`, `codex`, or `cherry-studio`.
</ParamField>

<ParamField path="remain_quota" type="integer">
  Quota available to this API key. When `unlimited_quota` is `true`, this field does not cap the key.
</ParamField>

<ParamField path="expired_time" type="integer">
  Unix timestamp. Use `-1` for no expiration.
</ParamField>

<ParamField path="unlimited_quota" type="boolean">
  Whether the API key has no key-level quota cap. The account balance is still charged normally.
</ParamField>

<ParamField path="model_limits_enabled" type="boolean">
  Whether to enable a model allowlist.
</ParamField>

<ParamField path="model_limits" type="string">
  Model allowlist value when model limits are enabled.
</ParamField>

<ParamField path="group" type="string">
  Groups assigned to the API key. Use commas for multiple groups, for example `codex,codex-passthrough`.
</ParamField>

<ParamField path="cross_group_retry" type="boolean">
  Whether to allow retrying across groups. This is usually used with `auto` or multi-group API keys.
</ParamField>

<ParamField path="allow_ips" type="string">
  Source IP allowlist for this API key. Leave empty for no IP restriction.
</ParamField>

## Get an API key

```text theme={"system"}
GET /api/token/{id}
```

<ParamField path="id" type="integer" required>
  API key ID.
</ParamField>

## Copy the full API key value

```text theme={"system"}
POST /api/token/{id}/key
```

Returns the full value for one of your own API keys. Call this only from a trusted environment, and do not expose the result to page scripts, logs, or untrusted systems.

## Update an API key

```text theme={"system"}
PUT /api/token/
```

Use the same fields as API key creation and include the target API key ID. For enable/disable-only changes, use `status_only`.

## Delete an API key

```text theme={"system"}
DELETE /api/token/{id}
```

After deletion, the API key can no longer call model APIs. In-flight requests may not be interrupted immediately.

## Search API keys

```text theme={"system"}
GET /api/token/search?keyword=claude
```

<ParamField path="keyword" type="string">
  Search by API key name.
</ParamField>

## Boundaries

* Manage only your own API keys.
* Do not infer admin endpoints from this user-facing management API.
* Automation scripts should handle expired sessions, 403 permission errors, and 429 rate limits.