Make your first request through Keylayer

Sign in

1. Open https://keylayer.app and click Sign in with Google.
2. Pick your Google account.

The dashboard opens on Credentials. Its menu also has Vault, Activity and Notifications.

Set up your vault

You type provider keys and approve new keys only in the vault, a separate page at https://vault.keylayer.dev. The dashboard opens it in a new window and never sees your provider key.

1. Open Vault and click Set up vault. If no window opens within 8 seconds, click Nothing opened? Open it here instead.
2. On Set up your vault, click Create a passkey and finish your browser's prompt.
3. On Write down your recovery code, write the code down and keep it offline. You won't see it again after setup. Click I wrote it down.
4. On Type your recovery code, type the code and click Check it.
5. On Confirm with your new passkey, click Confirm and use the passkey.

Your vault is ready means you're done. From now on, your passkey opens the vault. Your recovery code opens it too, after a 48-hour wait that any unlock with your passkey cancels.

Add your provider key

A credential is a provider key you add to Keylayer.

1. Open Credentials and click Add a credential.
2. Under Provider, pick OpenAI.
3. Under Where do your agents run?, keep Same region as this browser or pick the region your code runs in. Keylayer checks this credential's limits there, and you can't change it later.
4. Click Continue, check the provider, hosts and region, then click Open vault.
5. In the vault window, click Unlock with your passkey.
6. On Enroll your upstream key, paste your OpenAI API key into Upstream key and click Enroll.
7. The vault shows Your new key once. It's a Keylayer key with no limits of its own that works for 365 days, so guard it like the provider key itself. Click I saved it.

Your key is enrolled confirms it. The credential now shows under Credentials with the status Live.

Mint a key with a spend cap

1. On the OpenAI row under Credentials, click View keys, then Mint a key.
2. Type a Label such as quickstart. Keep Kind at Can't mint keys of its own and Lifetime at 1 hour, the default.
3. Open Limits. Under Spend in dollars, type 1 in A day and keep Limit at Hard.
4. Check the summary under Your vault will ask you to approve, then click Mint in your vault.
5. In the vault window, Approve a new key lists the same details. Leave Keep it in the vault, so it can be revealed later checked, since the dashboard can only edit limits on keys the vault keeps. Click Approve and use your passkey.
6. Your new key shows the key, which starts with kl_k_. Copy it now: the vault shows it once.

This key stops working after 1 hour. Its hard cap refuses any request whose worst-case cost doesn't fit in what's left of the $1 for the current UTC day, with status 403 and the code budget_exceeded.

Send a request

Put the key in an environment variable:

export KEYLAYER_KEY=kl_k_YOUR_KEY

Then set the SDK's base URL to the relay and pass the Keylayer key as the API key. Keylayer checks the key's limits, swaps in your OpenAI key and forwards the request to api.openai.com with the same method, path and query.

import os

from openai import OpenAI

client = OpenAI(
    base_url="https://relay.keylayer.dev/v1",
    api_key=os.environ["KEYLAYER_KEY"],
)

response = client.chat.completions.create(
    model="gpt-5.4-mini",
    messages=[{"role": "user", "content": "Say hello in five words."}],
    max_completion_tokens=1000,
)
print(response.choices[0].message.content)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://relay.keylayer.dev/v1",
  apiKey: process.env.KEYLAYER_KEY,
});

const response = await client.chat.completions.create({
  model: "gpt-5.4-mini",
  messages: [{ role: "user", content: "Say hello in five words." }],
  max_completion_tokens: 1000,
});
console.log(response.choices[0].message.content);

curl https://relay.keylayer.dev/v1/chat/completions \
  -H "Authorization: Bearer $KEYLAYER_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-5.4-mini",
    "messages": [{"role": "user", "content": "Say hello in five words."}],
    "max_completion_tokens": 1000
  }'

Check usage

On the Keys list, click View usage on your key. Usage by day shows requests, tokens in and out, data in and out, and cost for each UTC day. A request shows up a few seconds after it finishes.

When a request is refused

Every refusal from Keylayer itself carries a keylayer-error header with a code, while errors from OpenAI pass through without one. Once its hour is up, this key gets 401 with the code key_expired. Errors explains every code and what to do about it.