Skip to main content
Create and manage API keys on the token management page. Store keys only in server-side environment variables or a secret manager. Do not place them in client code, repositories, logs, screenshots, or public messages. Revoke or rotate a potentially exposed key immediately and review call logs. This page follows the LaoZhang API Terms and Data Policy and was last verified on September 2, 2026. Available console fields and permission controls may change.

​
Create an API key

  1. Sign in to the LaoZhang API console.
  2. Open token management.
  3. Select a name, group, credit limit, or other restrictions currently available in the console.
  4. Copy the new key and store it securely.
  5. Validate the endpoint, model, and billing group with a minimal request.
Do not send a complete API key in documentation, tickets, or public chats. Support normally needs the account, request time, model, error, and a redacted key identifier.

​
Environment variable

Set the key as an environment variable, then read it in code. The Python example uses the OpenAI SDK (pip install openai):
For production, prefer a cloud secret manager, container Secret, or encrypted deployment-platform environment variable. Do not print keys with echo, debug logs, or exception messages.

​
Least privilege and isolation

  • Use separate keys for development, testing, and production.
  • Use separate keys for different teams, services, or automations.
  • Apply group, credit, model, or expiration restrictions where the current console supports them.
  • Review and remove unused or unexplained keys.
  • Never embed a server API key in a browser, mobile application, or public client.

​
Rotate and revoke

Rotate or revoke immediately when:
  • a key appears in Git, logs, screenshots, tickets, or public messages;
  • unexplained requests or balance changes occur;
  • employee, contractor, or system access changes;
  • a dependency, server, or deployment credential is compromised;
  • support or security personnel request action.
Safe rotation sequence:
  1. Create a new key and validate it in a controlled environment.
  2. Update the server-side secret.
  3. Observe calls using the new key.
  4. Revoke the old key.
  5. Review call logs for the affected period.
Your organization should set rotation intervals based on its own risk and audit requirements. The documentation does not promise a universal rotation period or unlimited credit.

​
API key vs. system AccessToken

Normal model calls use an API key. Account-level balance or management APIs may use a separate system AccessToken; the two credentials are not interchangeable. See the balance query API for that specific permission boundary.

​
What to provide to support

Provide the account, key creation time, redacted key prefix and suffix, suspicious-call time, model, and error. Do not send the complete API key. If the key was exposed, revoke or rotate it before continuing the investigation.