Authentication
API keys, headers, limits and expiry.
Bearer keys
Every authenticated request carries an API key in the Authorization header:
Authorization: Bearer sk-amr-v1-<48 hex characters>Keys start with sk-amr-v1- followed by 48 lowercase hex characters (24 random bytes). We store only a SHA-256 hash of the key plus its first 14 and last 4 characters for display, so a key can never be shown again after creation. If you lose it, create a new one and revoke the old one.
Check a key
GET /key returns the key's limits, what it has used today, this month and in total, and your account balance. Agents and apps can use it to show a budget meter:
curl https://api.aimodelsrouter.ai/v1/key -H "Authorization: Bearer $AMR_API_KEY"- A limit that is not set is
null, and so is its*_remaining. Remaining is the limit minus usage;reservedis the holds of this key's requests still running. spendableis the most the key's next request can hold: the smallest of your available balance and each limit's remaining amount afterreserved.availableis your balance minus the holds of all requests currently running.
Key controls
| Control | Behavior |
|---|---|
| Credit limit | Lifetime spend. Once the key's usage plus in-flight holds would exceed it, requests fail with 402 key_limit_exceeded (limit: "total"). |
| Daily and monthly limits | Spend per UTC day (resets at 00:00 UTC) and per UTC month (resets on the 1st). Enforced the same way and never exceeded: a request starts, and a stream keeps going, only while its hold fits. Refusals are 402 key_limit_exceeded with limit and resets_at. |
| Daily tokens | Prompt plus output tokens per UTC day, checked when a request starts (the request that crosses it finishes). Then 429 key_token_limit_exceeded until 00:00 UTC. |
| Requests at once | How many of the key's requests may run at the same time. One more gets 429 concurrency_limited with Retry-After: 1. |
| Expiry | Optional date. After it, requests fail with 401 invalid_api_key. |
| Disable | Temporarily blocks the key. Re-enable it any time from the dashboard. |
| Revoke | Permanent. The key stops working immediately and cannot be restored. |
Every limit is optional. Set them when you create a key, or change them any time with Edit limits in the key's menu; changes apply to its next request. For unattended agents, a daily limit and a cap on requests at once keep a runaway loop from spending more than you planned.