API keys

API keys (z_sk_...) belong to an organization. Create your first key in the Developer console. Owners and admins can enable Admin access to provision a key that manages other keys through the API.

Permissions

For all three management endpoints, the calling API key must have admin: true, and its owner must still be an owner or admin of the organization. An ordinary inference key cannot manage keys. An OAuth bearer with cli:inference can also manage keys when its user is a current owner or admin. Browser cookies alone do not authenticate these endpoints. Send Authorization: Bearer or X-API-Key. The credential determines the organization; an optional X-Org-ID must match it. You cannot select another organization in the request body.

Create a key

curl https://app.trynito.ai/api/v1/api-keys \
  -H "Authorization: Bearer $NITO_ADMIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"document-worker","expires_in":"30d","spend_cap_period":"monthly","spend_cap_nanos":"10000000000"}'

A successful creation returns HTTP 201 with the secret nested under key.token:

{
  "key": {
    "id": "00000000-0000-4000-8000-000000000001",
    "name": "document-worker",
    "status": "active",
    "created_at": "2026-09-20T12:00:00Z",
    "expires_at": "2026-10-20T12:00:00Z",
    "admin": false,
    "spend_cap_period": "monthly",
    "spend_cap_nanos": "10000000000",
    "token": "z_sk_REPLACE_WITH_RETURNED_SECRET"
  }
}

Store the returned secret securely: it is shown only once. Creation requires API-console eligibility and funding.

Field	Meaning
`name`	Required, nonblank label.
`admin`	Defaults to `false`. Set `true` only for a key that needs organization administration.
`expires_in`	`never` (default), `10m`, `7d`, `30d`, `90d`, `180d`, `365d`, or an explicit UTC date or RFC3339 timestamp.
`spend_cap_period`	`daily`, `monthly`, or `overall`; supply together with `spend_cap_nanos`.
`spend_cap_nanos`	Positive decimal string in USD nanos. `1000000000` is $1; the example caps spending at$ 10 per month.

New keys have independent expiry and spend-cap settings; they do not inherit the calling key’s limits. Daily and monthly caps reset at their UTC window boundary. An overall cap expires the key when exhausted.

List keys

curl https://app.trynito.ai/api/v1/api-keys \
  -H "Authorization: Bearer $NITO_ADMIN_API_KEY"

HTTP 200 returns {"keys":[...]}. Each entry includes id, name, status, created_at, and admin, with optional expiry, last-use, revocation, and spend-cap metadata. Status is active, expired, or revoked. Listing never returns secrets or hashes.

Revoke and rotate

Create a replacement key, update your application, then revoke the old key:

curl -X DELETE "https://app.trynito.ai/api/v1/api-keys/$KEY_ID" \
  -H "Authorization: Bearer $NITO_ADMIN_API_KEY"

Success is HTTP 204 with no body. Revocation is immediate and permanent and preserves accounting history. A missing, already revoked, or other organization’s key returns 404. Revocation does not require a funded balance.

Administrative balance reads

Keys with admin: true can also call GET /api/v1/billing/balance, while their owner remains an organization owner or admin. Ordinary keys can inspect request-rate capacity without admin permission.

Basics

Features

Server-Side Tools

Multimodal

Best Practices

SDKs

API Reference

Permissions

Create a key

List keys

Revoke and rotate

Administrative balance reads

​Permissions

​Create a key

​List keys

​Revoke and rotate

​Related

​Administrative balance reads

Permissions

Create a key

List keys

Revoke and rotate

Related

Administrative balance reads