Key quota, expiration, and IP restrictions
Set clear limits for shared devices, automated tasks, or temporary use, to prevent keys from being abused and to avoid financial loss.
Three supported restrictions
| Restriction type | Effect | Use case |
|---|---|---|
| Quota limit | Automatically disables the key once its total consumption reaches the cap | Set a budget for friends/shared devices |
| Rate limit | Limits the number of requests per minute/hour | Prevent scripts from calling excessively |
| Expiration time | Automatically becomes invalid upon expiry | Temporary tasks, trials |
How to set restrictions
When creating a key, or by clicking the edit button for the key on the "API Keys" page:
- Quota limit: enter a USD quota or a token cap
- Rate limits: fill in the time window and the maximum number of requests
- Expiration time: choose a date; the key is automatically disabled when it expires
IP restrictions (if the site owner enables them)
Some sites let you set an IP allowlist/denylist for a key:
- IP allowlist: only IPs on the list can make requests; all others are rejected
- IP denylist: IPs on the list are rejected; all others are allowed
TIP
- Office network IPs can change, so confirm your outbound IP before setting an allowlist
- Using a proxy/VPN changes your outbound IP and may cause requests to fail
- If IP restrictions are silently cleared when you edit a key (an issue in older versions), check and set them again
What happens when a limit runs out
- Returns 429 (rate limit exceeded) or 403/insufficient balance (quota used up)
- The key does not recover automatically; you need to adjust the limits or wait for it to expire and then recreate it
Recommended combinations
| Scenario | Suggested configuration |
|---|---|
| Your primary machine | No limits or a high quota + no expiration |
| Sharing with friends | Quota $5 + rate 60/min + no expiration |
| Temporary automation tasks | Quota $1 + rate 30/min + 7-day expiration |
| Server with a fixed IP | Adding an IP allowlist is more secure |