Keylayer docs
Keylayer turns one provider key into scoped Keylayer keys for your apps, agents, scripts and teammates. Each Keylayer key carries up to 8 limits, such as a spend cap, a rate limit or an expiry date, and works with 11 providers through the relay at https://relay.keylayer.dev: you change the base URL and the key, and the rest of your code stays the same.
export OPENAI_BASE_URL="https://relay.keylayer.dev/v1"
export OPENAI_API_KEY="$KEYLAYER_KEY"- Your codesends a Keylayer key
- Keylayer relaychecks up to 8 limits
- 11 providersreceive your own key
Get started
- Make your first request through Keylayer
Sign in with Google, set up your vault, add your OpenAI key, mint a Keylayer key with a $1 daily spend cap and send a first request through the relay.
Concepts
- Keylayer keys, minting keys and child keys
Keylayer keys (kl_k_) call the relay, minting keys (kl_m_) create child keys, and a key you mint lasts 1 hour by default and 365 days at most.
- Key limits, from spend caps to path rules
Each Keylayer key can carry spend caps, request caps, a per-minute rate, a concurrency limit, an expiry and IP, method and path rules, checked on every request.
- Spend caps: what Keylayer reserves, charges and refuses
A spend cap reserves a request's worst case before forwarding, refuses with 403 budget_exceeded past the cap, then charges the usage the provider reports.
Providers
- Use OpenAI with a scoped key and a spend cap
Point the OpenAI SDK at relay.keylayer.dev/v1 with a Keylayer key to cap OpenAI spend per hour, day, week or month and block admin routes.
- Use OpenAI images, transcription and speech with a spend cap
Cap OpenAI image, transcription and speech spend per key: Keylayer prices GPT Image 2, whisper-1 and tts-1 calls before they reach OpenAI.
- Use Anthropic with a scoped key and a spend cap
Point the Anthropic SDK at relay.keylayer.dev with a Keylayer key to cap Claude API spend per hour, day, week or month and block the Admin API.
- Use the Gemini API with a scoped key and a spend cap
Point the Google Gen AI SDK at relay.keylayer.dev with a Keylayer key to cap Gemini API spend per hour, day, week or month and block token routes.
- Use Groq with a scoped key and a spend cap
Point the Groq SDK at relay.keylayer.dev, or the OpenAI SDK at relay.keylayer.dev/openai/v1, with a Keylayer key to cap Groq spend by the hour or day.
- Use Mistral with a scoped key and a spend cap
Point the Mistral SDK server URL at relay.keylayer.dev with a Keylayer key to cap Mistral spend per hour, day, week or month and block admin routes.
- Use OpenRouter with a scoped key and a spend cap
Point the OpenAI SDK at relay.keylayer.dev/api/v1 with a Keylayer key to cap OpenRouter spend per hour, day, week or month with an estimated cap.
- Use Hugging Face with a scoped key and a spend cap
Point huggingface_hub, @huggingface/inference or the OpenAI SDK at relay.keylayer.dev/-/router/v1 to call Hugging Face with a capped, revocable key.
- Use ElevenLabs with a scoped key and a spend cap
Point the ElevenLabs SDK at https://relay.keylayer.dev and cap text-to-speech and speech-to-text spend per key, priced per character and per second of audio.
- Use GitHub with a scoped key and a request cap
Point Octokit or curl at https://relay.keylayer.dev to give an agent a capped, revocable GitHub key, with 36 credential and access routes blocked.
- Use Replicate with a scoped key and a request cap
Point the replicate Python or JavaScript client at relay.keylayer.dev to run predictions with a capped, revocable key, with deployments blocked.
- Use Resend with a scoped key and a request cap
Set the Resend SDK base URL to https://relay.keylayer.dev to send email with a capped, revocable key, with API keys, domains and webhooks blocked.
Reference
- Keylayer error codes
Every error code the Keylayer relay returns, with its HTTP status and fix, and how to tell a Keylayer refusal from a provider error in your code.
Updated