API Keys
API keys (prefixed sk-) are the only credential WRouter accepts. Manage them under Console → API Keys.
Key list
Each key shows:
| Column | Meaning |
|---|---|
| Name | Your label |
| Status | Enabled / disabled |
| API key | Masked (e.g. sk-89wU**********0PPh); the copy icon copies the full key |
| Quota | Spend cap; "unlimited" = no cap |
| Group | The key's group |
| Models | Model restriction; "unlimited" = all models |
| IP restriction | Allowlist; "unlimited" = any source |
| Created / last used | For auditing |
| Expiry | "Never" = permanent |
Filter by name, by key, or by status. Select multiple rows for bulk copy or bulk delete via the bottom action bar.
Create a key
Click Create API Key (top right) and fill in the panel:
Basic info
| Field | Notes |
|---|---|
| Name | Free-form label, e.g. prod-server, personal-cli |
| Group | Pick a group; usually keep the default |
Expiry
Pick from the dropdown or use the quick buttons: Never / 1 month / 1 day / 1 hour — or set an exact date and time. Expired keys stop working automatically.
Quota
- The Unlimited quota toggle is on by default — no spend cap
- Turn it off to set a cap; recommended for production keys
Advanced settings
Expand to configure access restrictions (IP allowlist, model scope, etc.).
Click Save changes to finish.
Use a key
Add the header to every request:
Authorization: Bearer sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxOr in the OpenAI SDK:
python
client = OpenAI(api_key="sk-...", base_url="https://wrouter.ai/v1")Edit / disable / delete
- Edit — open the
…row menu → "Update API Key" panel: name, group, expiry, quota, advanced settings - Disable — the row's disable icon; temporary and reversible
- Delete — permanent
Suspected leak? Delete immediately and issue a new key.
Best practices
- One key per app — easier auditing and caps
- Turn off unlimited quota for production keys
- Pin IPs for fixed-egress production servers
- Use quick expiry (1 day / 1 hour) for throwaway keys
- Rotate every 90 days
- Never commit — use env vars or a secret manager
Monitoring
Per-key call detail lives in the Usage Logs, filterable by token. Disable on anomaly.