ARouter uses two distinct types of API keys with different permissions:
| Key Type | Prefix | Purpose |
|---|
| Standard API Key | lr_live_... | LLM inference, all /v1/* endpoints |
| Management API Key | lr_admin_... | Key management, /api/v1/keys/* endpoints only |
/v1/chat/completions or other inference endpoints. Standard keys cannot manage other keys.
Creating a Management API Key
- Go to ARouter Dashboard
- Click New Key
- Select Management Key type
- Copy the key — it’s shown only once
Use Cases
Management keys are designed for:
- CI/CD pipelines that rotate application keys on deployment
- Key provisioning services that create per-user or per-tenant keys
- Admin scripts that audit or clean up unused keys
- Terraform / infrastructure-as-code that manages key lifecycle
Key Management Endpoints
All management endpoints require a Management API key:
List Keys
curl https://api.arouter.ai/api/v1/keys \
-H "Authorization: Bearer lr_admin_xxxx"
{
"data": [
{
"hash": "abc123...",
"name": "production-app",
"label": "Production",
"created_at": "2026-01-01T00:00:00Z",
"last_used_at": "2026-04-01T12:00:00Z",
"usage": {"prompt_tokens": 1500000, "completion_tokens": 450000, "cost": 12.50},
"limit_usd": 100.0,
"rate_limit": {"requests_per_minute": 100}
}
]
}
Create a Key
curl -X POST https://api.arouter.ai/api/v1/keys \
-H "Authorization: Bearer lr_admin_xxxx" \
-H "Content-Type: application/json" \
-d '{
"name": "staging-app",
"label": "Staging",
"limit_usd": 25.0,
"allowed_models": ["openai/gpt-5.4", "anthropic/claude-sonnet-4.6"]
}'
{
"key": "lr_live_xxxx...",
"hash": "def456...",
"name": "staging-app"
}
The key value is returned only once at creation time. Store it securely — it cannot be retrieved again.
Update a Key
curl -X PATCH https://api.arouter.ai/api/v1/keys/{key_hash} \
-H "Authorization: Bearer lr_admin_xxxx" \
-H "Content-Type: application/json" \
-d '{
"label": "Staging (v2)",
"limit_usd": 50.0
}'
Delete a Key
curl -X DELETE https://api.arouter.ai/api/v1/keys/{key_hash} \
-H "Authorization: Bearer lr_admin_xxxx"
{"deleted": true, "hash": "def456..."}
Key Object Reference
| Field | Type | Description |
|---|
hash | string | Unique key identifier (safe to store, not the key itself) |
name | string | Internal name for your reference |
label | string | Display label shown in Dashboard |
created_at | string | ISO 8601 creation timestamp |
last_used_at | string | ISO 8601 timestamp of last use |
usage.prompt_tokens | integer | Cumulative prompt tokens |
usage.completion_tokens | integer | Cumulative completion tokens |
usage.cost | number | Cumulative cost in USD |
limit_usd | number|null | Spending limit. null = unlimited. |
rate_limit.requests_per_minute | integer|null | RPM limit. null = unlimited. |
allowed_models | string[]|null | Model allow-list. null = all models allowed. |
allowed_providers | string[]|null | Provider allow-list. null = all providers allowed. |
Automated Key Rotation
See API Key Rotation for a complete guide to zero-downtime key rotation using Management keys.
