Authentication & keys

Auth headers

We accept whichever header your existing SDK already sends, so you do not have to touch request construction.

Scoping keys

Keys carry their own limits. Create one per environment and per service. A leaked key with a $50 monthly cap is an inconvenience, and a leaked account-wide key is an incident.

• Spend cap: a hard monthly ceiling in USD. Requests past it return 402 budget_exceeded.
• Model allowlist: restrict a key to specific models, so a staging key cannot call your most expensive one.
• Request logging: off by default; opt in per key when you need an audit trail. See data handling.
• Expiry: an optional timestamp after which the key stops working. Useful for contractors and demos.

curl https://api.lowcostllm.com/v1/keys \
  -H "Authorization: Bearer $LOWCOSTLLM_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "checkout-service (staging)",
    "monthly_budget_usd": 50,
    "allowed_models": ["claude-haiku-4-5"],
    "log_requests": false,
    "expires_at": "2026-12-31T00:00:00Z"
  }'

Rotation

Rotation is additive, so there is no window where nothing works. Create the new key, deploy it, then revoke the old one once traffic has moved. The dashboard shows last-used time per key, which is how you confirm the old one is genuinely idle before you kill it.

If a key leaks