Why pasting your key goes wrong
A pasted key works for whoever holds it, wherever it ends up: a chat log, a committed .env file, an agent's memory. You can't tell whose requests are whose or limit one person, and the only way to cut one person off is to rotate the key, which breaks everyone else.
The providers agree. OpenAI's key safety guide says "Always use a unique API key for each team member on your account" and "The sharing of API keys is against the Terms of Use." Anthropic's says: "If someone needs access to the Claude API, they should obtain their own key."
Inviting colleagues to your provider account covers people with a login. It doesn't fit an agent, a CI job, a contractor for a week or a demo app, and spend limits there still cover a whole project or workspace, per month.
Four ways to share access
With OpenAI or Anthropic, these are the options, from best to worst:
| Option | What they hold | Cutting one off | Spend limit |
|---|---|---|---|
| Give them a Keylayer key | A scoped key, never the provider key | Revoke it, and the rest keep working | Per key, per UTC hour, day, week or month |
| Invite them to your account | A login and keys they create | Remove them | Per project or workspace, per month |
| Make them a provider key | A real key of their own | Delete that key | Per project or workspace, per month |
| Paste your provider key | Your real key | Rotate it and update everyone | Shared with all your own usage |
How sharing works with Keylayer
You add your provider key once, in the vault: a separate page at vault.keylayer.dev that opens with your passkey. Keylayer encrypts the key with AES-256-GCM, and the relay decrypts it in memory for each request. The people you share with never see it.
Then you mint a key for each person, agent or app, with a label you'll recognize in Activity. Each key carries its own limits:
- A spend cap in dollars per UTC hour, day, week or month, hard or estimated
- A request cap per period, a requests-a-minute limit and a limit on requests at once
- A lifetime from 1 minute to 365 days, 1 hour by default
- Up to 64 IP addresses or CIDR ranges, 16 HTTP methods and 64 path patterns
They send that key to https://relay.keylayer.dev with the provider's own SDK. Routes that manage your provider account, such as OpenAI's /v1/organization/** and Anthropic's /v1/organizations/**, are blocked by default, so a shared key can call the API but can't change your account. The security page covers how keys are stored.
Revoke, pause or rotate
Revoking a key stops it and every key below it right away, with no undo, and needs a Google sign-in from the last 9 minutes. Keylayer rechecks running requests every 10 seconds, so even a stream stops within about 10 seconds.
Keys the vault keeps can also be paused: set Status to Suspended under Edit limits, and the key and every key below it get 403 suspended until you set it back to Active. Rotating the provider key behind your Keylayer keys keeps all of them working, so you can rotate on your own schedule without handing out new keys.
Activity shows each key's usage by day, so you can see who spent what: 7 days of history on the free plan, 90 on Pro.
Let a teammate mint their own keys
A minting key creates keys below it, inside its own limits. Give a teammate or a service a minting key with a $50 monthly cap, and every key they mint stays inside that $50: no looser than its parent and never longer-lived. Revoke the minting key and everything below it stops.
A minting key can't call the relay itself, and whoever holds one can mint keys up to its limits, so keep it out of browsers and public code. Minting from your own code goes through the Keylayer API, and the keys docs cover how limits pass down.
Questions
Is it safe to share my OpenAI API key with a teammate?
Not the real key: OpenAI's key safety guide asks for a unique key per team member and says sharing keys is against its Terms of Use. Give each teammate a Keylayer key you can cap and revoke on its own, or invite them to your organization.
How do I share an API key with an AI agent?
Mint a Keylayer key for the agent with a daily spend cap, a short lifetime and only the paths it needs, and put it in the agent's environment. If the agent loops, it hits its cap and gets 403 budget_exceeded while your other keys keep working.
Can the person I share with see my provider key?
No. They hold a Keylayer key. The provider key stays encrypted in the vault, and only the relay decrypts it, in memory, for each request.
Can I see who used a shared key?
Yes. Each key has its own label, and Activity shows its requests, results, token counts and cost: 7 days of history on the free plan, 90 on Pro.
What does sharing cost?
The free plan covers 10 provider keys and 1,440 new Keylayer keys a day, with spend caps, expiry and revoke, which stops even running requests within about 10 seconds. Pro is $19 a month for 100 provider keys and no daily request cap.