LowRouterBeta

Create your first API key

API keys authenticate every request to the gateway. They are bearer tokens — anyone holding the string can spend your credits — so the rest of this page is about creating, scoping, and rotating them safely.

Create one

  1. Dashboard → Keys.
  2. Click New key.
  3. Give it a name that describes where it will be used (prod-server, local-dev, chatbox-personal). The name appears in the usage history and helps you find the right key to rotate later.
  4. Choose when it expires. Keys have a bounded lifetime — the default is 90 days, matching the widely-used rotation baseline. Pick a shorter window for high-sensitivity integrations, a longer one (up to 12 months) for long-running workloads, or Never as a deliberate opt-out. An expired key stops authenticating and shows an expired badge in the dashboard so you know to rotate it.
  5. Click Create. The full token shows once — copy it now.

Tokens look like sk-lr-... and are 40+ characters. The dashboard only ever shows the prefix and last four characters again.

Store it

  • Production — in your secret manager (Vault, AWS Secrets Manager, GCP Secret Manager, sealed Kubernetes secret, …). Never in source control.
  • Local development — in a .env file that is in .gitignore.
  • Personal tools — in the OS keychain, or in the tool’s own encrypted store. Avoid pasting the token into chat applications or notes apps that sync to the cloud.

A leaked key can be revoked from the dashboard at any time — see Rotate or revoke below — but it can spend credits in the seconds between the leak and the revocation. Treat keys like passwords.

Use it

The header is the standard Authorization: Bearer:

Bash
curl https://api.lowrouter.ai/v1/chat/completions \
  -H "Authorization: Bearer $LOWROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "auto/mistralai/mistral-large-2512",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

The Authorization header value is exactly Bearer followed by the token — no quotes, no spaces around the equals. SDKs accept the token as the constructor’s apiKey/api_key argument; see integrations.

Rotate or revoke

  • Rotate — create a second key, deploy it everywhere, then delete the old one. There is no built-in zero-downtime rotation; the pattern above gives you it without one.
  • Revoke — Dashboard → Keys → Delete. The token stops working on the next request, no caching delay.
  • Expiry — keys also lapse automatically at their expiry date (default 90 days). An expired key returns a 401 api_key_expired error; create a fresh key and rotate it in. Expired keys stay listed (marked expired) as a reminder, but their secret is purged at rest.

Rotate at least every 90 days, and immediately after any of:

  • A key was committed to a repository (even briefly).
  • A key was sent over an insecure channel.
  • A team member with access to the key left the organisation.
  • Unexpected usage shows up on the dashboard.

Next

Run your first completion →