Per-key spend caps
Set hourly, daily, weekly or monthly caps so an agent looping overnight stops before it runs through your budget.
CREDENTIAL GATEWAY FOR DEVELOPERS
Turn one API key into scoped keys.
Free to start, no card needed. Give agents, apps and teammates separate credentials across 11 providers like Anthropic, OpenAI and GitHub. Set up to 8 limits on each while the real key stays encrypted.
Get startedWHY KEYLAYER
Stop runaway spend
and leaked keys.
Agents stuck in loops run up bills overnight, and leaked keys stay active until rotated. Keylayer gives every agent its own API key with spend caps and IP rules, so you can pause or revoke a key without touching the rest.
Isolate every caller
Create separate API keys for agents, scripts or contractors. If one leaks, revoke it without touching the others.
Pause, revoke, expire
Pause a key to stop its next call, set an expiry up to 365 days out, or revoke it to cut access for good.
Keep your SDK
Keep using the provider's official SDK or standard HTTP calls. You only change the base URL and the API key.
HOW IT WORKS
How Keylayer handles requests.
Keylayer sits between your code and API providers. When a request arrives, Keylayer checks it against that key's limits, attaches your real provider key and forwards it. Your code only ever holds the Keylayer key.
- 1
Connect provider key
Add your provider API key once. It's stored encrypted and never shown again, even in the dashboard.
- 2
Create Keylayer keys
Generate as many keys as you need, each with its own spend caps, rate limits, expiry and IP rules.
- 3
Change two lines
Point your SDK base URL to relay.keylayer.dev and pass your Keylayer key instead of the provider key.
- 4
Watch and adjust
Review spend and usage in the dashboard. Update limits anytime and changes take effect within seconds.
DASHBOARD
See every key in one dashboard.
Track every key you've issued, what it can do and what it has spent. Pause or edit keys, rotate your real provider key and see each key's usage by day without storing prompts or responses.
- Spend tracking per key
- Pause or revoke anytime
- Rotate provider keys
- No prompts stored
LIMITS
Combine limits on each key.
Apply any combination of limits to a key. Sub-keys can never exceed parent limits, and changes take effect within seconds on the next request.
Spend cap
A dollar cap per hour, day, week or month. On supported providers, hard mode checks maximum cost before forwarding and refuses requests that exceed it. Estimated mode counts cost after and can go over the cap.
Request cap
Set a maximum number of allowed requests per hour, day, week or month.
Rate limit
Set a maximum number of requests per minute to prevent bursts.
Concurrency
Control how many requests can run at the same time on a single key.
Expiry
Set the exact date and time a key stops working, up to 365 days out.
IP allowlist
Only requests from the IP addresses and ranges you list get through.
Methods
Only the HTTP methods you list get through, like GET or POST.
Paths
Only the paths you list get through. Use * for one segment and end with ** to match the rest.
PROVIDERS
Connect 11 providers through one gateway.
Keep each provider's official SDK and change two lines. Spend caps, request caps and controls work across models, voice and developer tools.
import OpenAI from "openai";
const openai = new OpenAI({
baseURL: "https://relay.keylayer.dev/v1",
apiKey: process.env.KEYLAYER_KEY,
});Hard or estimated spend caps
- OpenAI
- Anthropic
- Google Gemini
- Groq
- Mistral
Estimated spend caps
- OpenRouter
- ElevenLabs
- Hugging Face
Request caps
- Replicate
- Resend
- GitHub
Rate limits, concurrency, expiry and IP allowlists work with every provider.
AT A GLANCE
Simple setup across providers.
- 11
- built-in providers
- 2
- lines to change
- 0
- prompts stored
FAQ
Questions and straight answers.
What is Keylayer and how does it work?
Keylayer is a gateway between your code and API providers. You connect your provider API key once, where it's stored encrypted and never displayed again. Then you generate Keylayer keys with custom limits. When requests arrive, Keylayer checks limits and forwards the call with your real key attached. Your code only ever touches Keylayer keys.
How does a spend cap stop a runaway agent?
In hard mode on supported providers, Keylayer checks the maximum possible cost before forwarding. If it doesn't fit under your cap or can't be calculated up front, the request is refused. With a $50 daily cap in hard mode, an agent looping stops at $50 instead of running all night. In estimated mode, costs are counted after requests finish, so calls running when the cap is reached can take the total over the cap.
Do you store my prompts or model responses?
No. Keylayer never stores prompts or responses, which means request and response bodies are never saved. Query string values are also excluded. The activity log records which key called which provider and path, query parameter names, user agents, IP addresses, timestamps, results, token counts and costs. Your provider API key is stored encrypted so Keylayer can forward calls, but payload contents are never retained. Our privacy policy explains what we keep and for how long.
Do I need to install a new SDK?
No. You keep the provider's official SDK or standard HTTP requests. You only change two lines of configuration: replace the provider's hostname with relay.keylayer.dev while keeping the same endpoint paths, and pass your Keylayer key instead of your real provider key. Everything else in your code stays identical.
How do I tell a Keylayer limit error from a provider error?
Every error response Keylayer generates carries a keylayer-error header containing the reason. A missing or invalid Keylayer key gets a plain JSON body like {"error": "invalid_token"}. Errors from your key's limits, like budget_exceeded, come in the provider's own error format, so your SDK raises its normal exception. Errors coming directly from the provider pass through unchanged without that header.
Can an agent bypass its limits or escalate permissions?
No. Keys created from another key can never have looser limits than their parent key. On built-in providers, admin routes that manage keys, organizations, members and settings are blocked by default. The only way around Keylayer is having the real provider key itself, so you should keep that key out of your agents' hands entirely.
What happens when I pause or revoke a key?
When you pause a key, its next request is refused, and a request that's already running, streams included, stops within about 10 seconds. You can unpause it later to resume traffic. When you revoke a key, it's permanently disabled and stops the same way. Work the provider has already completed cannot be undone.
Which providers work with Keylayer?
There are 11 built-in providers. Hard or estimated spend caps work on OpenAI, Anthropic, Google Gemini, Groq and Mistral. Estimated spend caps work on OpenRouter, ElevenLabs and Hugging Face. Request caps apply to Replicate, Resend and GitHub. Rate limits, concurrency, expiry and IP allowlists work on every provider.
How do I get started with Keylayer and how much does it cost?
Keylayer is free to start. Sign in with Google at keylayer.app, connect your provider API key, then create Keylayer keys with up to 8 limits each. The free plan needs no card and includes 10 provider keys, 5,000 requests a day on each and 1,440 new Keylayer keys a day. Pro is $19 a month or $190 a year for 100 provider keys, no daily request cap and 90 days of activity history. The pricing page lists every limit.
GET STARTED
Make your first
scoped key.
Sign in with Google, connect your provider API key and set up to 8 limits on each key.
Get started