Key format
Keys look like llmr_sk_live_<random>
(or llmr_sk_test_<random> for a sandbox key).
The plaintext secret is shown exactly once, at creation time — we only ever store its hash, plus a
prefix and last4
for display in the dashboard.
Send it as a standard bearer token on every serving request:
Authorization: Bearer llmr_sk_live_...
Missing, malformed, revoked, or expired keys all get a 401 —
see Errors & rate limits for the full table.
Creating a key
Create an account, verify your email, then open
/dashboard and create a key. New accounts must
verify their email before any key can be created; unverified attempts get a 403.
New accounts start on prepaid credits — see Pricing & billing
before sending live traffic.
Per-key policy
Every key carries its own policy, set at creation and editable afterward — there's no separate rate-limit or budget system to wire up:
| Field | Default | Meaning |
|---|---|---|
| mode | balanced | default routing mode (cost/balanced/quality) for model:"auto" requests; a request body mode overrides it per call |
| rpm_limit / tpm_limit | unlimited | requests/min and tokens/min; unset or 0 means no cap |
| monthly_spend_cap_usd | uncapped | hard ceiling on this key's spend for the month; requests near the cap get max_tokens clamped to what's left |
| model_allowlist | all models | restrict this key to specific model slugs — model:"auto" only ever routes within the allowlist too |
| scopes | * (all) | restrict which endpoints this key can call — see below |
| expires_at | never | set an expiry in days at creation time; the key 401s after that date |
Scopes
A key's scopes field is a comma-separated
list gating which serving endpoints it may call: chat
(/v1/chat/completions, /v1/route),
embeddings (/v1/embeddings), and
completions (/v1/completions).
The default, *, allows all three. Calling an
endpoint outside a key's scopes returns a 403 insufficient_scope.
Rolling & revoking
Roll a key from the dashboard to rotate its secret in place: a new secret is issued inheriting the exact same policy (mode, limits, allowlist, scopes), and the old secret is revoked in the same transaction — it stops working immediately, so there's never a window where both are valid.
Revoke a key to disable it permanently with no replacement. Both actions are self-service from /dashboard — no support ticket needed.
Test vs. live keys
A test-env key
(llmr_sk_test_…) hits an in-process sandbox
echo on every endpoint — it exercises the full request/response shape, streaming, routing decision, and response
headers, but never calls a real provider, never spends credits, and never requires a funded balance. Swap in a
live key, same code, when you're ready to
serve real traffic.
Provisioning API
Building a product on top of LLMRouter and need to mint a key per end-user programmatically? A separate
provisioning-kind key drives CRUD over
standard keys scoped to your own org — GET/POST /api/v1/keys,
GET/PATCH/DELETE /api/v1/keys/{"{hash}"}. A provisioning
key is inference-forbidden (it can't call /v1/* itself) and can only ever see or
mint keys that spend against your own org's funded balance. Contact us if you need one issued.