---
title: 'API keys'
description: 'Create an organization or department key, bind it to a region, and call the Token Streamer model API.'
url: 'https://docs.streamtoken.dev/api-keys'
last_updated: '2026-11-11'
---

> Docs index: https://docs.streamtoken.dev/llms.txt · MCP: https://docs.streamtoken.dev/mcp · Skill: https://docs.streamtoken.dev/skill.md

# API keys

An API key lets your app call the Token Streamer model API at `https://router.streamtoken.dev/v1`. First [connect a provider](https://docs.streamtoken.dev/providers.md) in the current organization. Its eligible models become available when you create a key.

## Create a key

1. Open **API keys** from the sidebar or your user menu.
2. Select the option to create a key, and name it for its integration.
3. Choose a scope (see below), an optional expiration, and the models the key can use.
4. Copy the key before you close the confirmation.

Owners and administrators can create and revoke keys. The full key is shown once. Token Streamer stores only a hash and a short prefix, so it cannot show the key again. If you lose it, create a replacement and revoke the old key.

Use the key as a Bearer token:

```bash
curl https://router.streamtoken.dev/v1/models \
  -H "Authorization: Bearer $STREAMTOKEN_API_KEY"
```

A management API for creating keys from code is planned.

## Choose the key scope

Every new key needs an explicit scope. There is no default.

- **Organization**: the key can use every model the organization allows. Its spend does not count against any department limit.
- **Department**: the key is limited to that department's models and spending limit. You can pick only a department you belong to.

## Region-bound keys

The workspace header shows the active region. **API keys** lists only keys in that region, and the create dialog names the region before it issues a key. Eligible models come from the provider connections saved for that region.

Each key is permanently bound to the region it was issued in. Switching the workspace region does not reroute existing keys. Create separate Europe and United States keys to use both regions in one organization. A request for a different region is refused, and the router never changes region as a fallback.

## Keep keys safe

- Keep keys on your server, outside source control and browser code.
- Do not share a key between unrelated integrations.
- A key belongs to the organization where it was created. Switching workspaces does not change that.
- A key stays active when its creator later leaves. An owner or administrator should revoke keys during offboarding when appropriate.
- A key's models are checked on every request. If a model is removed from the organization, the key loses it on the next request without a new key. A department key is refused on the next request after its department member leaves the organization.

## Revoke a key

Choose **Revoke** beside the key and confirm. New requests are refused after revocation or expiration; requests already authorized may finish. Revocation cannot be undone. Create a new key when an integration needs access again.

## Understand API errors

Errors use an `error` object with `message`, `type`, `param` and `code`. Every response includes a request ID in `X-Request-Id`.

| Status | Code | What to do |
| --- | --- | --- |
| 401 | `invalid_api_key` | Check the key. It may be missing, unknown, expired, revoked, or attached to a deleted organization. |
| 400 | `invalid_json` or `invalid_request` | Check the JSON and message structure. |
| 400 | `unsupported_parameter` | Remove the unsupported field named in `param`. |
| 404 | `model_not_found` | Choose a model returned by `GET /v1/models` for this key. |
| 413 | `payload_too_large` | Reduce the request body size. |
| 415 | `unsupported_media_type` | Send `application/json`. |
| 429 | (rate limit) | Slow down. See the traffic limits below. |
| 503 | `gateway_unavailable` | Retry later. |

For request formats and more error codes, see the [model API reference](https://docs.streamtoken.dev/api-reference.md).

## Organization traffic limits

Token Streamer assigns traffic limits to each organization. You cannot change the request rate, concurrency or access state yourself.

Current ceilings are **60 requests per minute** and **8 concurrent requests** per organization. Assigned limits can be lower. All of an organization's API keys and regions share the same limits, so creating more keys does not add capacity. Requests above the limits can receive HTTP 429. Provider account quotas and availability apply separately, so these ceilings do not guarantee provider throughput.

Token Streamer can pause new access for an organization. A pause does not cancel running requests or discard their usage. Contact support to change a limit or resolve an access issue. Key permissions, provider connections, department rules and regions are independent of these limits.