# API Key Scopes and Limits

Creates and rotates API keys and sets scopes, spending limits and expiry dates.

- Repository: https://github.com/cheaper-inference/OmniRoute (83611 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add cheaper-inference/OmniRoute --skill omni-api-keys -g -a claude-code -y`
Codex: `npx skills add cheaper-inference/OmniRoute --skill omni-api-keys -g -a codex -y`
Cursor: `npx skills add cheaper-inference/OmniRoute --skill omni-api-keys -g -a cursor -y`
Gemini CLI: `npx skills add cheaper-inference/OmniRoute --skill omni-api-keys -g -a gemini-cli -y`

## Description

Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration. Keys gate access to all proxy and management endpoints.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!-- generated by src/lib/agentSkills/generator.ts; manual edits will be overwritten -->

## Overview

Create, list, rotate, and revoke OmniRoute API keys. Control per-key scopes, spending limits, and expiration. Keys gate access to all proxy and management endpoints.

## Authentication

All requests require a valid Bearer token or session cookie. Obtain a token via `POST /api/auth/login` or configure `REQUIRE_API_KEY=false` for local development.

## Endpoints

### GET /api/keys

List API keys

```bash
curl http://localhost:20128/api/keys \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/keys

Create API key

```bash
curl -X POST http://localhost:20128/api/keys \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### GET /api/keys/{id}

Get API key

```bash
curl http://localhost:20128/api/keys/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### PATCH /api/keys/{id}

Update API key

```bash
curl -X PATCH http://localhost:20128/api/keys/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'
```

### DELETE /api/keys/{id}

Delete API key

```bash
curl -X DELETE http://localhost:20128/api/keys/{id} \
  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
```

### POST /api/keys/{id}/access

Add or remove allowed models and combos on an API key atomically

Adds or removes allowed models and combos on an API key without lost updates.
Serialized per key ID using an in-process async lock.
Keys allowing all models (modelAccessMode: all) or all combos (allowedCombos containing 'combo/*')
require switchToRestricted: true when adding new models or combos, otherwise returning a 409 Conflict.
When switching to restricted mode, the allowlist becomes exactly the net added items (at least one required).
Direct concurrent PATCH calls to /api/keys/{id} completely overwrite the policy outside this lock.

The rest: https://github.com/cheaper-inference/OmniRoute/blob/HEAD/skills/omni-api-keys/SKILL.md