---
title: "Obtaining and Managing API Keys"
description: "Create sk- prefixed API keys in the 1zheAI console, and how to store, rotate, and limit damage when leaked."
headingIds: {"Creating an API Key":"section-1","One API Key Per Tool":"section-2","Where to Store It":"section-3","What to Do If It’s Leaked":"section-4","FAQ":"section-5"}
---
An API key corresponds to one set of call permissions, and charges are deducted from your account balance. This page explains how to create one, where to store it, and what to do if something goes wrong.
## Creating an API Key
Open [1zheai.com/console](https://1zheai.com/console?lng=en).
Click "API Keys" in the left sidebar menu, then click "Create API Key" in the top right. Fill in a name that shows its purpose, such as `claude-code-macbook`, `ci-staging`. Other fields can be left at their defaults and it will still work; click "Save Changes".
Configurable fields in the form:
| Form Field | Default | Description |
|---|---|---|
| Name | Empty | Used to distinguish API keys in call logs |
| Expiration | Never expires | Choose 1 hour, 1 day, 1 month, or specify an exact date and time |
| Quantity | 1 | Create multiple at once; names get a random suffix added automatically |
| "Unlimited Quota" toggle | On | When turned off, a "Quota (USD)" field appears; this API key can spend at most that many USD |
| Model Restrictions (under "Advanced Settings") | Empty, meaning all models allowed | Once models are selected, this API key can only call those models |
| IP Allowlist (under "Advanced Settings") | Empty, meaning no restriction | Only allows calls from the listed IPs or CIDR ranges |
API keys start with `sk-`. After copying, put it in a password manager or environment variable; do not paste it into chats, screenshots, or code repositories.
## One API Key Per Tool
It is recommended to create a separate API key for each tool and each machine. There are three benefits:
- Call logs are separated by API key, so you can see at a glance which tool spent how much.
- If one API key is leaked, you only delete that one; other tools are unaffected.
- In a team, each person is responsible for their own API key; delete the corresponding key when someone leaves or switches machines.
## Where to Store It
```bash title="Shell 配置（macOS / Linux）"
# 写进 ~/.zshrc 或 ~/.bashrc，只在本机生效
export ONEZHE_API_KEY="sk-你的Key"
```
```powershell title="Windows（当前用户，持久）"
[Environment]::SetEnvironmentVariable("ONEZHE_API_KEY", "sk-你的Key", "User")
# 重新打开终端后生效
```
```bash title=".env（项目本地）"
# .env 要写进 .gitignore
ONEZHE_API_KEY=sk-你的Key
```
Claude Code's project-level `.claude/settings.json` is usually committed to the repository, and Claude Code's official documentation explicitly recommends not writing credentials here. Put the API key in the user-level `~/.claude/settings.json`, or in a `.claude/settings.local.json` in the project that is not committed.
## What to Do If It’s Leaked
1. Find it in the "API Keys" list, click the "Disable" icon in the "Actions" column, or select "Delete" from the "⋯" menu. Once disabled it takes effect immediately; further calls with it return 401 `Invalid token`.
2. Create a new API key and replace it wherever the old one was used.
3. Open the call logs (console menu "Call Logs"), click "Expand", and filter by entering this API key's name in "Token Name" to check whether any recent calls were not initiated by you.
## FAQ
Yes, API keys are not bound to a tool. However, mixing them makes it unclear in the logs who spent the money, so it is still recommended to create them separately.
Mostly yes. Common causes: spaces or line breaks copied along with the key, the API key has been deleted, or it was entered into the wrong field in the tool. For step-by-step troubleshooting see [Error Codes and Troubleshooting](/en/docs/troubleshooting/).
By default they never expire. When creating or editing, you can set a time in "Expiration"; after expiration, calls return 401 `Invalid token`, the same response as when an API key is entered incorrectly. The "Expiration" column in the list shows each API key's expiration time.