LowRouterBeta

Create your first API key

API keys authenticate every request to the gateway. They are bearer tokens: anyone holding the string can spend your credits. The rest of this page covers creating, scoping, and rotating them safely.

Create one

  1. Open the Keys page.
  2. Click New key.
  3. Give it a name that describes where it will be used (prod-server, local-dev, chatbox-personal). The name appears in the usage history and helps you find the right key to rotate later.
  4. Choose when it expires. Keys have a bounded lifetime. The default is 90 days, the common rotation baseline. Pick a shorter window for high-sensitivity integrations, a longer one (up to 12 months) for long-running workloads, or Never as a deliberate opt-out. An expired key stops authenticating and shows an expired badge in the dashboard so you know to rotate it.
  5. Click Create. The full token shows once, so copy it now.

Tokens look like sk-lr-... and are 40+ characters. The dashboard only ever shows the prefix and last four characters again.

Store it

In production, keep it in your secret manager (Vault, AWS Secrets Manager, GCP Secret Manager, a sealed Kubernetes secret, and so on), never in source control. For local development, use a .env file that is in .gitignore. For personal tools, use the OS keychain or the tool’s own encrypted store. Avoid pasting the token into chat applications or notes apps that sync to the cloud.

You can revoke a leaked key from the dashboard at any time (see Rotate or revoke below), but it can spend credits in the seconds between the leak and the revocation. Treat keys like passwords.

Use it

The header is the standard Authorization: Bearer:

Bash
curl https://api.lowrouter.ai/v1/chat/completions \
  -H "Authorization: Bearer $LOWROUTER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "auto/mistralai/mistral-large-2512",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

The Authorization header value is exactly Bearer followed by the token, with no quotes and no spaces around the equals. SDKs accept the token as the constructor’s apiKey/api_key argument; see integrations.

Rotate or revoke

  • Rotate: create a second key, deploy it everywhere, then delete the old one. There is no built-in zero-downtime rotation, but this pattern avoids downtime.
  • Revoke: on the Keys page, use Delete. The token stops working on the next request, with no caching delay.
  • Expiry: keys also lapse automatically at their expiry date (default 90 days). An expired key returns a 401 api_key_expired error; create a fresh key and rotate it in. Expired keys stay listed (marked expired) as a reminder, but their secret is purged at rest.

Rotate at least every 90 days, and immediately after any of:

  • A key was committed to a repository (even briefly).
  • A key was sent over an insecure channel.
  • A team member with access to the key left the organisation.
  • Unexpected usage shows up on the dashboard.

Next

Run your first completion →