API keys in the organization
See and revoke the personal API keys in your organization and set the monthly limit.
Organization admins manage the personal API keys of their organization on the API keys page in the Organization section of Settings. The page is titled Organization API keys and always refers to the organization you are currently working in. Admin rights do not open it; it is only for people with the Organization admin role.
Who may create keys is decided by the API keys role on the People page (see Roles). The role applies in every organization the person belongs to; the admins of each organization see and revoke the keys of their own organization.
Monthly Limit for LiteLLM Keys
The LiteLLM keys section sets the Monthly limit per person in euros: how much each person may spend with their LiteLLM keys per month. As long as no limit is set, nobody in the organization can create LiteLLM keys, and the page says so: “No limit set yet. Until then, nobody in … can create LiteLLM keys.”
Set the monthly limit for LiteLLM keys
- 1
Open the profile menu, select Settings and open API keys in the Organization section.
- 2
Under Monthly limit per person, enter an amount, for example 25.00.
- 3
Select Save. AITEZA confirms with Limit saved.
- The limit applies to each person: it covers all of the person’s LiteLLM keys in the organization together, including keys revoked or expired in the same month. Someone with two LiteLLM keys cannot spend more than someone with one.
- LiteLLM enforces the limit itself and starts it again at the beginning of each month. Once a person’s keys have used it up, LiteLLM refuses their requests until then.
- A new limit applies to every person right away.
- The amount must be greater than 0, have at most two decimal places and be at most €1,000,000.
- Remove limit asks for confirmation. Afterwards, nobody in the organization can create new LiteLLM keys. Existing keys keep the previous limit; to stop them right away, revoke them.
- What the keys spend appears on the Usage page under the name of the person the key belongs to.
All Keys of the Organization
Active keys lists every active key of the organization, grouped by person with name and email address. Each key shows the same details as on the personal page: type, beginning of the key, access or spend, and its dates. Expired and revoked keys are not listed. The keys themselves are never shown, not to admins either.
Revoking Someone’s Key
- 1
On the API keys page in the Organization section, select Revoke next to the key.
- 2
The confirmation names the key and the person, for example “Revoke “Monthly report” of …?”. Confirm with Revoke.
Programs using the key lose access immediately. As long as the person has the API keys role, they can create a new key. To stop someone from using keys at all, take the role away. This revokes all their keys right away, in every organization they belong to, because the role applies in all of them. Giving the role back does not bring the old keys back.
Creating and revoking keys and changing the monthly limit are recorded in the Audit Log under Administration, as “API key created”, “API key revoked” and “LiteLLM key limit changed” (action codes API_KEY_CREATED, API_KEY_REVOKED and API_KEY_LIMIT_CHANGED). Keys that end because of an account action, the loss of the role or the loss of access are recorded as “API key revoked” as well. The event details name who revoked the key (revokedBy): the admin, or system when AITEZA revoked it automatically.
Requests that AITEZA refuses for a known key, for example an administrative function, another organization or a change with a Read key, are recorded under Other as “Access denied” (action code ACCESS_DENIED), with the key’s ID and name (apiKey and apiKeyName). This way, the misuse of a stolen key shows up.
