Keys and limits
On this page
Every request to the API is authenticated with an sk-aic-… key. An account has one balance and can have several keys, each with its own limits and its own line in the stats.
Creating a key#
A key is created in the dashboard, on the Keys page. The name and the limits are optional; a name is up to 100 characters.
The full key is shown once, right after it is created. We store only its hash and its first characters, which is how you tell a key in the list. A lost key cannot be recovered: create a new one and revoke the old.
Keep the key in an environment variable, not in project files that get committed:
export AIC_API_KEY=sk-aic-…Key limits#
All four are optional. An empty field means no limit.
| Limit | What is counted | Answer past the limit |
|---|---|---|
| Requests per minute | The key’s requests over the last minute. | 429 rate_limit_exceeded |
| Tokens per minute | Input tokens over the last minute, by estimate: the request body size in bytes divided by 4. | 429 rate_limit_exceeded; a request that alone exceeds the whole limit gets 400 request_too_large |
| Monthly spend, $ | The key’s spend over the calendar month in UTC, including the reserve of requests still running. | 429 monthly_limit_exceeded |
| Allowed models | The list of models the key may call. | 403 model_not_allowed |
- The per-minute limits say when to retry: the 429 comes with a
retry-afterheader. - The monthly cap is checked against the reserve for a request, not its final price: a request is refused when its reserve no longer fits under the cap. The key stays stopped until the next month or until the cap is raised.
- A key restricted to some models sees only those in
GET /v1/models.
How the reserve works is in Billing and usage.
Editing a key#
The name and the limits of an existing key are changed on the same Keys page, with the Edit button. The key itself stays the same, so nothing changes in your tools’ settings.
- New limits apply from the key’s next request. A request already running finishes under the old ones.
- If you lower the monthly cap below what the month has already spent, the next requests get 429
monthly_limit_exceededuntil the new month or until you raise the cap. - A revoked key cannot be edited.
Service limits#
These apply to every key and cannot be changed in the dashboard:
- at most 120 requests and 2,000,000 tokens per minute per key. When the key has a limit of its own, the lower of the two applies;
- at most 20 active keys per account. Creating one more returns 409; revoked keys don’t count.
Concurrent requests#
One key runs at most 4 requests at a time. The next one gets 429 concurrent_requests with a retry-after header; Claude Code retries it by itself. If you need more in parallel, several agents at once for example, spread them across keys.
Per-IP limit#
One IP address may send at most 60 requests per minute, 300 per five minutes and 1,200 per hour to each API endpoint (/v1/messages, /v1/chat/completions and the others are counted apart). It counts the address, not the key: a second key on the same machine does not raise it. Past it comes a 429 as plain text, with no JSON and no error.code, with a retry-after header. More in Errors and limits.
Revoking and rotating#
A revoked key stops working from its next request, with 401 invalid_api_key. It cannot be brought back. It stays in the list and does not count toward the limit of active keys.
To rotate a key without downtime: create a new one, switch your tools to it, then revoke the old one.
A key per tool#
A separate key per tool, machine or project is a simple way to see who spends what: the dashboard’s stats filter by key, and the month’s spend is right in the list of keys. A monthly cap on such a key bounds one tool’s spend without touching the rest.