Team keys and usage

A team API key belongs to a project and identifies a service, environment, Agent or automated task. It inherits the project boundary and can add tighter budget, model and routing limits. Personal keys suit individual experiments; production services should use team keys.

Create a team key

Open “Team members → API key management”, select the project and fill in:

  • Name: include the application, environment and purpose, for example support-prod-agent.
  • Budget: cannot exceed the budget available in the project.
  • Routing mode: Balanced, Lowest cost or Fastest.
  • Model access: expose only the public models actually required.

The full key value appears only briefly, when the key is created or revealed by an authorized user. Copy it into your server-side secret manager immediately; do not send it in chat tools or ticket bodies.

Server-side usage

export INONEAPI_API_KEY="ioa_sk_..."
import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.INONEAPI_API_KEY,
  baseURL: "https://api.inoneapi.com/v1",
});

const result = await client.chat.completions.create({
  model: "YOUR_MODEL_ID",
  messages: [{ role: "user", content: "你好" }],
});

console.log(result.choices[0]?.message.content);

Browsers and mobile clients cannot store server-side keys safely; call InOneAPI from your own backend.

Review usage

The usage records page filters requests by project, key, model and date. When troubleshooting, focus on:

  • X-Gateway-Trace-ID
  • Public model and upstream channel
  • Status code and retry count
  • Input, output, cache read and cache write tokens
  • TTFT and total latency
  • Per-request cost

The platform stores this billing and diagnostic metadata, but does not persist prompts or completions to the database.

Rotation and revocation

Rotating two keys at a time is recommended:

  1. Create a new key with the same required permissions as the old one.
  2. Update the secret manager and the service configuration.
  3. After the release, observe successful requests on the new key.
  4. Confirm the old key carries no traffic.
  5. Revoke the old key.

On a leak, do not wait for the regular rotation window: revoke immediately, create a new key, and check usage for anomalies by time and trace. Removing a member is not a substitute for rotating server-side credentials.

Agent usage recommendations

Give every Agent tool its own team key. Model access and budgets can then be limited separately, and retry storms or runaway tasks are easier to identify. Agent-side guardrails are still required: cap maximum turns, require command approval and use a sandbox. A gateway budget does not replace local execution safety policy.

Team keys and usage · Documentation · InOneAPI