2. Creating and Managing API Keys#
The API Key is the single credential used by every endpoint.
Get an API Key (console walkthrough)#
- Sign in to the YiTuoToken console.
- Click API Keys in the left navigation to open the key management page.
- Click the Create API Key button.
- In the dialog that opens, fill in:
- Key name (required, e.g. "Production service"; used to tell keys apart)
- Quota limit (optional; leave empty for no limit)
- IP allowlist (optional; restricts which source IPs / CIDRs may call)
- Expiration time (optional; the key is automatically disabled after expiry)
- Model allowlist (optional; restricts which models the key may call)
- Click Create Key to submit.
- A Save your new key dialog appears — the full plaintext key is shown this one time only. Click Copy Key to save it somewhere safe, then click I have saved it to close.
Once the dialog is closed, the full key can never be viewed again. The system stores only a hash of the key; the plaintext is never persisted. If you did not save it in time, revoke the key and create a new one.
Configurable options#
| Option | Description |
|---|---|
| Name | Helps tell keys apart by purpose (e.g. "Production", "Local testing") |
| Quota limit | Maximum quota this key may consume; once exhausted, requests return 402 |
| IP allowlist | Restricts source IPs; supports single IPs and CIDR ranges (comma-separated) |
| Validity period | The key is automatically disabled after expiry |
| Model allowlist | Restricts which models this key may call |
Management operations#
- Revoke: Revoke a key immediately if it leaks or is no longer used; after revocation, every request with that key returns
401. - Rotate: Create new keys regularly and phase out old ones to reduce the risk of leaks.
Security note: Never hard-code API keys into frontend code, public repositories, or client apps. Keep them in environment variables or a backend service instead.