Skip to main content

​
Short Answer

When a token (API Key) shows unexplained usage, three steps are the safest path:
  1. Trace it first: copy the KEY and search across chat history, code repos, and config files to confirm who received it and where it’s used.
  2. Disable it if untraceable: if you genuinely can’t find the user, just disable that token — the impact is usually minimal.
  3. Harden the account: change the account password and tighten console permissions; non-essential people shouldn’t log into the console.
Below is the detailed playbook, plus how to pin down the real caller using the true request IP in the logs.

​
Investigation Steps

1

Step 1: Trace where the KEY went

Copy the token’s KEY and run a global search across the following to confirm who it was given to and where it was configured:
  • Chat history with colleagues / contractors / clients (WeChat, Lark, email, etc.)
  • Code repositories and commit history (including deleted branches, .env, config files)
  • Environment variables / secrets stored in deployment platforms, CI/CD, and third-party tools
Most “mystery usage” turns out to be an old config left running somewhere — one search for the KEY usually identifies it.
2

Step 2: If untraceable, just disable that token

If you still don’t know who’s using it after Step 1, disabling that token is the fastest way to stop the bleeding.Tokens are independent of one another — disabling one does not affect the other tokens under your account, so the impact is usually minimal. Once you’ve confirmed no one is using it legitimately, disable it, and create a replacement token if needed.
3

Step 3: Harden the account and permissions

While stopping the loss, tighten account security:
  • Change the account password to a strong one
  • Tighten console permissions — non-essential people should not log into the console
  • Let staff check KEY usage only through the Query section, with no need to enter the console

​
How to Pin Down the Real Caller via Logs

In the console’s Logs section, you can see the token, model, and IP for each call. Hover over the IP of a log entry to reveal the IP details for that call: 
📍 Main IP:
   IP: 104.194.93.159          ← APIYI's traffic-distribution IP (not the caller)

🔁 Proxy IP:
   X-Forwarded-For: 18.163.84.xx
   X-Real-IP:       18.163.84.xx   ← your true request IP (the actual user)
How to read the two IPs?
  • Main IP: APIYI’s traffic-distribution IP — the same for all customers, and does not indicate the call’s origin.
  • X-Real-IP (and X-Forwarded-For) under Proxy IP: this is the IP that actually made the call, i.e. the real user’s IP.
When investigating, rely on X-Real-IP: match it to a machine / network to identify who is calling.
Cross-reference the token for speed: the log also shows the token and model used. Filter logs by the suspicious token first, then see which addresses its X-Real-IP clusters around — that usually points straight to a specific person or service.

​
Frequently Asked Questions

No. Each token is independent; disabling one does not affect the other tokens or normal workloads under your account. As long as the token has no legitimate use, you can disable it safely and create a replacement if needed.
No. The Main IP (e.g. 104.194.93.159) is APIYI’s traffic-distribution IP, identical for all calls — this is normal. To judge the call’s origin, look at X-Real-IP under Proxy IP.
No. We recommend giving staff only the Query section for self-service usage checks, and reserving console admin access for essential people — this reduces the risk of account and key abuse at the source.
A few habits: don’t hardcode the KEY in code — use environment variables; split tokens by purpose so they can be disabled individually; rotate KEYs periodically; and reclaim the relevant token when someone leaves or a project ends.

Token Management

Full guide to creating, disabling, and assigning tokens

Call Logs

How to view the token, model, and IP for each call

Logs & Privacy Control

Logging scope and privacy settings

Data Security

APIYI’s data security and access-control mechanisms

​
Contact Us

If you still have questions after investigating, reach out to our technical support:

Technical Support