> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trynito.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# API keys

> Create, list, rotate, and revoke organization API keys with spend caps.

API keys (`z_sk_...`) belong to an organization. Create your first key in the [Developer console](https://app.trynito.ai/api). Owners and admins can enable **Admin access** to provision a key that manages other keys through the API.

## Permissions

For all three management endpoints, the calling API key must have `admin: true`, and its owner must still be an owner or admin of the organization. An ordinary inference key cannot manage keys. An OAuth bearer with `cli:inference` can also manage keys when its user is a current owner or admin. Browser cookies alone do not authenticate these endpoints.

Send `Authorization: Bearer` or `X-API-Key`. The credential determines the organization; an optional `X-Org-ID` must match it. You cannot select another organization in the request body.

## Create a key

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl https://app.trynito.ai/api/v1/api-keys \
  -H "Authorization: Bearer $NITO_ADMIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"document-worker","expires_in":"30d","spend_cap_period":"monthly","spend_cap_nanos":"10000000000"}'
```

A successful creation returns HTTP `201` with the secret nested under `key.token`:

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
{
  "key": {
    "id": "00000000-0000-4000-8000-000000000001",
    "name": "document-worker",
    "status": "active",
    "created_at": "2026-09-20T12:00:00Z",
    "expires_at": "2026-10-20T12:00:00Z",
    "admin": false,
    "spend_cap_period": "monthly",
    "spend_cap_nanos": "10000000000",
    "token": "z_sk_REPLACE_WITH_RETURNED_SECRET"
  }
}
```

Store the returned secret securely: it is shown only once. Creation requires API-console eligibility and funding.

| Field | Meaning |
| - | - |
| `name` | Required, nonblank label. |
| `admin` | Defaults to `false`. Set `true` only for a key that needs organization administration. |
| `expires_in` | `never` (default), `10m`, `7d`, `30d`, `90d`, `180d`, `365d`, or an explicit UTC date or RFC3339 timestamp. |
| `spend_cap_period` | `daily`, `monthly`, or `overall`; supply together with `spend_cap_nanos`. |
| `spend_cap_nanos` | Positive decimal **string** in USD nanos. `1000000000` is $1; the example caps spending at $10 per month. |

New keys have independent expiry and spend-cap settings; they do not inherit the calling key's limits. Daily and monthly caps reset at their UTC window boundary. An overall cap expires the key when exhausted.

## List keys

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl https://app.trynito.ai/api/v1/api-keys \
  -H "Authorization: Bearer $NITO_ADMIN_API_KEY"
```

HTTP `200` returns `{"keys":[...]}`. Each entry includes `id`, `name`, `status`, `created_at`, and `admin`, with optional expiry, last-use, revocation, and spend-cap metadata. Status is `active`, `expired`, or `revoked`. Listing never returns secrets or hashes.

## Revoke and rotate

Create a replacement key, update your application, then revoke the old key:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -X DELETE "https://app.trynito.ai/api/v1/api-keys/$KEY_ID" \
  -H "Authorization: Bearer $NITO_ADMIN_API_KEY"
```

Success is HTTP `204` with no body. Revocation is immediate and permanent and preserves accounting history. A missing, already revoked, or other organization's key returns `404`. Revocation does not require a funded balance.

## Related

* [Create endpoint](/api/api-reference/endpoints/api-keys/create)
* [List endpoint](/api/api-reference/endpoints/api-keys/list)
* [Revoke endpoint](/api/api-reference/endpoints/api-keys/revoke)
* [Authentication](/api/api-reference/overview/authentication)
* [Secure key handling](/api/features/best-practices/secure-api-key-handling)

## Administrative balance reads

Keys with `admin: true` can also call [`GET /api/v1/billing/balance`](/api/api-reference/usage/get-balance), while their owner remains an organization owner or admin. Ordinary keys can inspect [request-rate capacity](/api/api-reference/errors-and-rate-limits/rate-limits#inspect-current-capacity) without admin permission.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.