> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arouter.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Management API Keys

> Management API keys are separate credentials used exclusively for ARouter admin operations — creating, listing, and deleting API keys. They cannot be used for LLM inference.

ARouter uses two distinct types of API keys with different permissions:

| Key Type               | Prefix         | Purpose                                         |
| ---------------------- | -------------- | ----------------------------------------------- |
| **Standard API Key**   | `lr_live_...`  | LLM inference, all `/v1/*` endpoints            |
| **Management API Key** | `lr_admin_...` | Key management, `/api/v1/keys/*` endpoints only |

Management keys cannot call `/v1/chat/completions` or other inference endpoints. Standard keys cannot manage other keys.

## Creating a Management API Key

1. Go to [ARouter Dashboard](https://arouter.ai/keys)
2. Click **New Key**
3. Select **Management Key** type
4. Copy the key — it's shown only once

## Use Cases

Management keys are designed for:

* **CI/CD pipelines** that rotate application keys on deployment
* **Key provisioning services** that create per-user or per-tenant keys
* **Admin scripts** that audit or clean up unused keys
* **Terraform / infrastructure-as-code** that manages key lifecycle

## Key Management Endpoints

All management endpoints require a Management API key:

### List Keys

```bash theme={null}
curl https://api.arouter.ai/api/v1/keys \
  -H "Authorization: Bearer lr_admin_xxxx"
```

```json theme={null}
{
  "data": [
    {
      "hash": "abc123...",
      "name": "production-app",
      "label": "Production",
      "created_at": "2026-01-01T00:00:00Z",
      "last_used_at": "2026-04-01T12:00:00Z",
      "usage": {"prompt_tokens": 1500000, "completion_tokens": 450000, "cost": 12.50},
      "limit_usd": 100.0,
      "rate_limit": {"requests_per_minute": 100}
    }
  ]
}
```

### Create a Key

```bash theme={null}
curl -X POST https://api.arouter.ai/api/v1/keys \
  -H "Authorization: Bearer lr_admin_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "staging-app",
    "label": "Staging",
    "limit_usd": 25.0,
    "allowed_models": ["openai/gpt-5.4", "anthropic/claude-sonnet-4.6"]
  }'
```

**Response:**

```json theme={null}
{
  "key": "lr_live_xxxx...",
  "hash": "def456...",
  "name": "staging-app"
}
```

<Note>
  The `key` value is returned **only once** at creation time. Store it securely — it cannot be retrieved again.
</Note>

### Update a Key

```bash theme={null}
curl -X PATCH https://api.arouter.ai/api/v1/keys/{key_hash} \
  -H "Authorization: Bearer lr_admin_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Staging (v2)",
    "limit_usd": 50.0
  }'
```

### Delete a Key

```bash theme={null}
curl -X DELETE https://api.arouter.ai/api/v1/keys/{key_hash} \
  -H "Authorization: Bearer lr_admin_xxxx"
```

```json theme={null}
{"deleted": true, "hash": "def456..."}
```

***

## Key Object Reference

| Field                            | Type             | Description                                               |
| -------------------------------- | ---------------- | --------------------------------------------------------- |
| `hash`                           | `string`         | Unique key identifier (safe to store, not the key itself) |
| `name`                           | `string`         | Internal name for your reference                          |
| `label`                          | `string`         | Display label shown in Dashboard                          |
| `created_at`                     | `string`         | ISO 8601 creation timestamp                               |
| `last_used_at`                   | `string`         | ISO 8601 timestamp of last use                            |
| `usage.prompt_tokens`            | `integer`        | Cumulative prompt tokens                                  |
| `usage.completion_tokens`        | `integer`        | Cumulative completion tokens                              |
| `usage.cost`                     | `number`         | Cumulative cost in USD                                    |
| `limit_usd`                      | `number\|null`   | Spending limit. `null` = unlimited.                       |
| `rate_limit.requests_per_minute` | `integer\|null`  | RPM limit. `null` = unlimited.                            |
| `allowed_models`                 | `string[]\|null` | Model allow-list. `null` = all models allowed.            |
| `allowed_providers`              | `string[]\|null` | Provider allow-list. `null` = all providers allowed.      |

***

## Automated Key Rotation

See [API Key Rotation](/en/guides/administration/api-key-rotation) for a complete guide to zero-downtime key rotation using Management keys.

## Related

* [Key Management](/en/guides/key-management) — Managing keys from the Dashboard
* [API Key Rotation](/en/guides/administration/api-key-rotation) — Automated rotation strategies
* [Guardrails](/en/guides/features/guardrails) — Setting limits and policies on keys