Limits & Access

Manage your whole team’s budgets and access rules in one place under Settings → Limits & access in the console. This prevents unexpected overspending and stops a leaked API key from being abused.

Rule	What it does	Where to set it
Budget cap	Stops calls once the cap is reached	Team, members: Limits & access; keys: API Keys
IP allowlist	Allows calls only from specified servers	Team: Limits & access; keys: key menu → IP Whitelist
Allowed models	Limits which models can be called	Team: Limits & access; keys: key menu → Allowed models
Request rate	Requests per minute shared by all keys in the team	View only; see Rate Limits

Only team Owners and Admins can change these rules. Every change is recorded in Change history at the top right of the page.

Budget caps

Budgets apply at three levels — team, member and API key — and the period can be Daily, Monthly or Total.

Team budget: the spending cap for the whole team
Default member budget: counted per member; if a member has their own budget, that one applies instead
Key budget: set for an individual key on the API Keys page

Each level is counted separately, and a request is blocked as soon as any level runs out. Within the same period, a key budget can’t exceed its member’s budget, and a member budget can’t exceed the team budget.

Each budget has an action:

Action	When the cap is reached
Notify and block	Sends an email alert and stops calls
Notify only	Sends an email alert only; doesn’t block

Topping up does not restore calls once a budget is used up. Raise the cap, or wait for the daily / monthly period to reset.

IP allowlist

Allow calls only from specified IPv4 addresses or CIDR ranges, up to 100 entries. Requests from addresses not on the list are rejected.

Team IP allowlist: applies to every API key in the team
Key IP allowlist: narrows the team list further for a single key; an address on a key’s list only takes effect if it’s also on the team list

This is a good way to lock production keys to your own servers: even if a key leaks, no one can call with it from anywhere else.

Allowed models

Teams can choose one of three modes, and models can be selected in bulk by vendor:

Mode	Description
All models	Every model can be called, including models released later
Only these models	Only models on the list can be called; models released later can’t be called either
Block these models	Models on the list can’t be called; other models are unaffected

An individual key can be narrowed further under Allowed models in the key menu. Team and key rules apply together: only models allowed by both can be called.

Check effective rules

Each key is governed by both team rules and key rules. In API Keys, open the key menu and click Check effective rules, then pick a model to see whether a call would be blocked, which rule would block it, and how much budget is left. Checking doesn’t use credits.

Responses when a request is blocked

Requests blocked by a budget or access rule won’t succeed on retry; adjust the rule first:

Status	Error code	Cause	What to do
`402`	`spending_limit_exceeded`	The team, member or key budget cap was exceeded	Raise the cap, or wait for the period to reset
`402`	`insufficient_credits`	Insufficient balance	Top up
`403`	`ip_not_allowed`	The caller IP is not on the allowlist	Add the IP to the team or key allowlist
`403`	`model_not_allowed`	The team or key doesn’t allow this model	Use another model, or change the allowed models
`503`	`spending_limit_check_unavailable`	The budget can’t be confirmed right now	Retry later

Blocked requests appear under the Blocked filter in Activity. For the full list of error codes, see Error Handling.

Change history

For the IP allowlist, allowed models and budgets, you can see who changed what and when in Change history at the top right of Limits & access. Log retention settings aren’t recorded here; see Request Logs.