Which providers let keys expire
Every Keylayer key expires, on all 11 providers it supports. Several providers also let you set an expiry when you create a key, but they differ on how short it can be, whether you can change it, and whether it exists at all:
| Provider | Key expiry |
|---|---|
| Keylayer, on any of its 11 providers | 1 minute to 365 days, 1 hour by default, never extended |
| OpenAI | An optional expiration date on project keys, and a maximum lifetime admins can enforce |
| Anthropic | 3 hours, 1 day, 7 days, 30 days, a custom duration or never, fixed when the key is created |
| GitHub | Fine-grained tokens last 1 to 366 days or never, and organizations can set a maximum |
| ElevenLabs | User API keys can expire after 15 minutes to 30 days, or never |
| Mistral | An expiration date you set when you create the key |
| Google Cloud API keys, used by Gemini | No expiry setting; Google recommends rotating keys periodically |
OpenAI also supports workload identity federation: a workload trades an identity from a trusted provider for a short-lived OpenAI access token. It only covers OpenAI and only works where such an identity exists, while a Keylayer key works the same for a script, an agent or a contractor.
What native expiry doesn't give you is the same rules everywhere: Google API keys have no expiry setting, the shortest lifetime differs by provider, and OpenAI and Anthropic cap spend per project or workspace, not per key. A Keylayer key brings one set of lifetime rules to every provider it supports.
How Keylayer key lifetimes work
When you mint a key you pick its lifetime: 1 hour, the default; For a number of minutes, hours or days, from 1 minute to 365 days; or Until a time in UTC, up to 365 days out.
Two rules keep lifetimes honest: a key never outlives the key it was minted from, and nothing can extend a lifetime later. On keys the vault keeps, a Stops working time in UTC can end the key sooner, and you can move it earlier or later within the lifetime. To keep the option of extending access, mint with a long lifetime and a near Stops working time.
Once the lifetime is over, the relay refuses the key with 401 key_expired, and past its Stops working time with 401 expired. The request never reaches the provider, every refusal names its code in a keylayer-error header, and running requests, streams included, stop within about 10 seconds.
A provider key you add lasts 365 days in Keylayer, and no key below it can outlive it, so add a new credential before then to keep long-lived keys running. The keys docs cover every rule.
Mint temporary keys from code
For keys made on demand, one per CI run, agent session or workshop seat, mint them from your own code. A minting key creates keys through the Keylayer API, each no looser than the minting key and never longer-lived.
The free plan mints up to 1,440 keys a day, and Pro has no daily cap. A provider key can back up to 500 live keys at a time, and 5,000 on Pro. Keep minting keys on a server you control, never in a browser or public code: whoever holds one can mint keys up to its limits.
Where temporary keys fit
- A contractor gets a 7-day key with a $25 weekly cap, and access ends when the work does.
- A CI job gets a 1-hour key for its test run, so a key leaked in a build log is dead within the hour.
- An agent gets a key per session, with a request cap and only the paths it needs.
- A workshop gets a key per attendee that stops working at 18:00 UTC.
Questions
How long can a temporary API key last?
From 1 minute to 365 days. If you don't choose, a Keylayer key lasts 1 hour.
Can I extend a key that's about to expire?
Not past its lifetime, which can't be extended. Within the lifetime, you can move a Stops working time later on keys the vault keeps, so mint with a long lifetime and a near Stops working time when you might need more.
What does my code see when a key expires?
401 key_expired once the lifetime ends, or 401 expired once its Stops working time passes. The error comes in the provider's format, with a keylayer-error header naming the code.
Can I end a temporary key early?
Yes. Revoke it, and it stops along with every key below it. On keys the vault keeps, you can also move its Stops working time earlier or set its status to Suspended. Running requests stop within about 10 seconds.
Do temporary keys work with GitHub?
Yes. GitHub is one of Keylayer's 11 built-in providers. Its keys take expiry, request caps, rate limits and IP rules, but not spend caps.