API Keys
Creating an API key
Go to API keys and click Create key. Fill in the name (required), optionally a credit limit, reset period and expiration. The key is generated after saving and shown once.
Credit limit and reset period
- Credit limit, IDR: maximum spend for the key. Once reached, requests return
402 key_budget_reacheduntil the period resets or you raise the limit. - Reset limit every: Never / Daily / Weekly / Monthly. Only meaningful when a limit is set.
- Limits stack: key limit, then workspace limit, then organization balance. The first one hit wins.
Expiration
None / 1 hour / 1 day / 7 days / 30 days / 90 days / 180 days / 1 year, counted from now. Expired keys return 401 key_expired. Change it any time from the key detail page; a new value counts from now.
Key format
libra_sk_ followed by 40 random characters (49 total). The list shows only the first 12 characters. LIBRA stores a SHA-256 hash, never the plaintext.
The full key is shown only once at creation. Never paste it into chat tools, screenshots or repositories.
Guardrails and owner
- New keys get the workspace's default guardrails automatically. Change on the key detail page.
- The creator is the owner. Owner/Superadmin/Admin can reassign or clear it to make the key shared with the whole workspace.
Enabling, disabling and deleting
- Disable keeps the configuration but the key fails with
401 key_disabled. Enable restores it. - Delete needs the key name typed back. Irreversible:
401 invalid_api_keyafterwards. Usage history stays, labelled (deleted); stored request bodies are purged immediately. - Move to workspace (Owner, Superadmin) detaches guardrails and clears the owner if they are not in the new workspace.
What if my key is leaked?
Disable it on the API keys page right away, then Delete it and create a new one. Set a credit limit and an allowed-model list via Guardrails on every production key so a leak is bounded.