---
title: "API keys: limits and allowed models — AI Creator API"
description: "AI Creator API keys: creating and editing a key, request, token and spend limits, allowed models and concurrent requests."
url: https://llm.aicreator.app/en/docs/keys/
lang: en
updated: 2026-11-10
---

# Keys and limits

Every request to the API is authenticated with an `sk-aic-…` key. An account has one balance and can have several keys, each with its own limits and its own line in the stats.

## Creating a key

A key is created in the dashboard, on the [Keys page](https://llm.aicreator.app/en/app/keys/). The name and the limits are optional; a name is up to 100 characters.

The full key is shown once, right after it is created. We store only its hash and its first characters, which is how you tell a key in the list. A lost key cannot be recovered: create a new one and revoke the old.

Keep the key in an environment variable, not in project files that get committed:

```bash
export AIC_API_KEY=sk-aic-…
```

## Key limits

All four are optional. An empty field means no limit.

| Limit               | What is counted                                                                                  | Answer past the limit                                                                                |
| ------------------- | ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- |
| Requests per minute | The key’s requests over the last minute.                                                         | 429 `rate_limit_exceeded`                                                                            |
| Tokens per minute   | Input tokens over the last minute, by estimate: the request body size in bytes divided by 4.     | 429 `rate_limit_exceeded`; a request that alone exceeds the whole limit gets 400 `request_too_large` |
| Monthly spend, $    | The key’s spend over the calendar month in UTC, including the reserve of requests still running. | 429 `monthly_limit_exceeded`                                                                         |
| Allowed models      | The list of models the key may call.                                                             | 403 `model_not_allowed`                                                                              |

- The per-minute limits say when to retry: the 429 comes with a `retry-after` header.
- The monthly cap is checked against the reserve for a request, not its final price: a request is refused when its reserve no longer fits under the cap. The key stays stopped until the next month or until the cap is raised.
- A key restricted to some models sees only those in `GET /v1/models`.

How the reserve works is in [Billing and usage](https://llm.aicreator.app/en/docs/billing/#hold).

## Editing a key

The name and the limits of an existing key are changed on the same Keys page, with the Edit button. The key itself stays the same, so nothing changes in your tools’ settings.

- New limits apply from the key’s next request. A request already running finishes under the old ones.
- If you lower the monthly cap below what the month has already spent, the next requests get 429 `monthly_limit_exceeded` until the new month or until you raise the cap.
- A revoked key cannot be edited.

## Service limits

These apply to every key and cannot be changed in the dashboard:

- at most 120 requests and 2,000,000 tokens per minute per key. When the key has a limit of its own, the lower of the two applies;
- at most 20 active keys per account. Creating one more returns 409; revoked keys don’t count.

### Concurrent requests

One key runs at most 4 requests at a time. The next one gets 429 `concurrent_requests` with a `retry-after` header; Claude Code retries it by itself. If you need more in parallel, several agents at once for example, spread them across keys.

### Per-IP limit

One IP address may send at most 60 requests per minute, 300 per five minutes and 1,200 per hour to each API endpoint (`/v1/messages`, `/v1/chat/completions` and the others are counted apart). It counts the address, not the key: a second key on the same machine does not raise it. Past it comes a 429 as plain text, with no JSON and no `error.code`, with a `retry-after` header. More in [Errors and limits](https://llm.aicreator.app/en/docs/errors/#service-limits).

## Revoking and rotating

A revoked key stops working from its next request, with 401 `invalid_api_key`. It cannot be brought back. It stays in the list and does not count toward the limit of active keys.

To rotate a key without downtime: create a new one, switch your tools to it, then revoke the old one.

## A key per tool

A separate key per tool, machine or project is a simple way to see who spends what: the dashboard’s stats filter by key, and the month’s spend is right in the list of keys. A monthly cap on such a key bounds one tool’s spend without touching the rest.