https://api.apiyi.com/api/token/: POST to create, GET to list or fetch one, PUT to update (add ?status_only=true to just toggle enabled/disabled), DELETE to remove. The most common use is bulk issuance — one key per teammate, downstream customer, or project, each capped by remain_quota, restricted to a models allowlist, and expiring at expired_time.
Authentication again uses the raw system token with no Bearer prefix. Note that the system token cannot call models itself, but it can create keys that do — so leaking it is far more damaging than leaking a single API key. Store it at account-password level and rotate it periodically.
Three implementation details are documented: the key in the create response is plaintext and does not include the sk- prefix, so prepend it yourself; there is no server-side bulk create — passing something like count has no effect, batches are a client-side loop; and model_limits, model_limits_enabled, and allow_ips are accepted without error but currently have no effect, so use models to restrict which models a key can call. Also, unlimited_quota defaults to false while remain_quota defaults to 0 — omitting both creates a zero-quota key that cannot be used.
📖 Related: Token Management API · How to create a KEY · Log Query API
← Back to Live Updates · 📚 Monthly Archive