Management API Keys

Management keys (ak_…) administer your account from scripts and CI without your dashboard password: LLM keys, presets, BYOK providers, credits and your own management keys.

Two kinds of keys

Request

Create a key in the dashboard (Create key, name, scopes; the secret is shown once), or with a session-authenticated request:

Scopes

Scopes are action:resource; write:X implies read:X. Grant the smallest set a key needs.

Other routes

Response

POST /api/v1/management-keys returns the plaintext secret once — store it immediately. Revocation is immediate: the next request with a revoked key returns 401.

Examples

curl -X POST https://anyrouter.dev/api/v1/management-keys \
  -H "Content-Type: application/json" \
  --cookie "__session=<your-session-cookie>" \
  -d '{
    "name": "CI deploy bot",
    "description": "Used by the GitHub Actions deploy workflow",
    "scopes": ["read:credits", "write:llm-keys"],
    "expires_at": "2027-01-01T00:00:00Z"
  }'

curl https://anyrouter.dev/api/v1/credits \
  -H "Authorization: Bearer ak_live_..."

curl https://anyrouter.dev/api/v1/management-keys \
  -H "Authorization: Bearer ak_live_..."

curl -X DELETE https://anyrouter.dev/api/v1/management-keys/<key_id> \
  -H "Authorization: Bearer ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{"revocation_reason": "Rotated for quarterly audit"}'

BYOK keys

read:byok lists your provider keys; write:byok adds, rotates, donates and removes them.

Every key object carries two fields beyond the id, provider, label, and quota:

Pass source when adding a key to tell scripts' keys apart later:

curl -X POST https://anyrouter.dev/api/v1/auth/byok \
  -H "Authorization: Bearer ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{"provider_id": "openai", "api_key": "sk-proj-…", "label": "laptop", "source": "cli"}'

source accepts cli, dashboard, or api; any other value is rejected with 400 source must be 'cli', 'dashboard', or 'api'. The dashboard sends dashboard. The anyr binary doesn't send cli yet, so its keys report api.

{
  "id": "byok_01JQZ…",
  "provider_id": "openai",
  "label": "laptop",
  "key_preview": "sk-p****7c2",
  "enabled": true,
  "route_coverage": "all",
  "kind": "byok",
  "source": "cli"
}

key_preview is masked (first four characters, ****, last three). The key itself is never returned.

Organization-scoped keys

Keys you create while an organization is active are owned by the org: any member with access can use them and revocation is org-wide. Personal keys authenticate only you.

Errors