Skip to content
1ZheAI Docs
English

Obtaining and Managing API Keys

Create sk- prefixed API keys in the 1zheAI console, and how to store, rotate, and limit damage when leaked.

An API key corresponds to one set of call permissions, and charges are deducted from your account balance. This page explains how to create one, where to store it, and what to do if something goes wrong.

Creating an API Key

Section titled “Creating an API Key”

  1. Log in to the console

    Open 1zheai.com/console.

  2. Create new

    Click “API Keys” in the left sidebar menu, then click “Create API Key” in the top right. Fill in a name that shows its purpose, such as claude-code-macbook, ci-staging. Other fields can be left at their defaults and it will still work; click “Save Changes”.

    Configurable fields in the form:

    Form FieldDefaultDescription
    NameEmptyUsed to distinguish API keys in call logs
    ExpirationNever expiresChoose 1 hour, 1 day, 1 month, or specify an exact date and time
    Quantity1Create multiple at once; names get a random suffix added automatically
    “Unlimited Quota” toggleOnWhen turned off, a “Quota (USD)” field appears; this API key can spend at most that many USD
    Model Restrictions (under “Advanced Settings”)Empty, meaning all models allowedOnce models are selected, this API key can only call those models
    IP Allowlist (under “Advanced Settings”)Empty, meaning no restrictionOnly allows calls from the listed IPs or CIDR ranges

  3. Copy & save

    API keys start with sk-. After copying, put it in a password manager or environment variable; do not paste it into chats, screenshots, or code repositories.

One API Key Per Tool

Section titled “One API Key Per Tool”

It is recommended to create a separate API key for each tool and each machine. There are three benefits:

  • Call logs are separated by API key, so you can see at a glance which tool spent how much.
  • If one API key is leaked, you only delete that one; other tools are unaffected.
  • In a team, each person is responsible for their own API key; delete the corresponding key when someone leaves or switches machines.

Where to Store It

Section titled “Where to Store It”
Shell 配置（macOS / Linux）
# 写进 ~/.zshrc 或 ~/.bashrc，只在本机生效
export ONEZHE_API_KEY="sk-你的Key"

Claude Code’s project-level .claude/settings.json is usually committed to the repository, and Claude Code’s official documentation explicitly recommends not writing credentials here. Put the API key in the user-level ~/.claude/settings.json, or in a .claude/settings.local.json in the project that is not committed.

What to Do If It’s Leaked

Section titled “What to Do If It’s Leaked”
  1. Find it in the “API Keys” list, click the “Disable” icon in the “Actions” column, or select “Delete” from the ”⋯” menu. Once disabled it takes effect immediately; further calls with it return 401 Invalid token.
  2. Create a new API key and replace it wherever the old one was used.
  3. Open the call logs (console menu “Call Logs”), click “Expand”, and filter by entering this API key’s name in “Token Name” to check whether any recent calls were not initiated by you.

FAQ

Section titled “FAQ”
Can one API key be used by both Claude Code and Cursor?

Yes, API keys are not bound to a tool. However, mixing them makes it unclear in the logs who spent the money, so it is still recommended to create them separately.

Does Invalid token / 401 mean there's a problem with my API key?

Mostly yes. Common causes: spaces or line breaks copied along with the key, the API key has been deleted, or it was entered into the wrong field in the tool. For step-by-step troubleshooting see Error Codes and Troubleshooting.

Do API keys expire?

By default they never expire. When creating or editing, you can set a time in “Expiration”; after expiration, calls return 401 Invalid token, the same response as when an API key is entered incorrectly. The “Expiration” column in the list shows each API key’s expiration time.