Skip to main content
Create and manage API keys on the token management page. A token can spend up to your whole account balance, so give every token limits such as a quota and keep it on the server side. If a key may be exposed, disable it first, then review call logs. This page follows the LaoZhang API Terms and Data Policy and was last verified on October 5, 2026. Available console fields and permission controls may change.

​
Create an API key

  1. Sign in to the LaoZhang API console.
  2. Open token management.
  3. Select a name, group, credit limit, or other restrictions currently available in the console.
  4. Copy the new key and store it securely.
  5. Validate the endpoint, model, and billing group with a minimal request.
Do not send a complete API key in documentation, tickets, or public chats. Support normally needs the account, request time, model, error, and a redacted key identifier.

​
Environment variable

Set the key as an environment variable, then read it in code. The Python example uses the OpenAI SDK (pip install openai):
For production, prefer a cloud secret manager, container Secret, or encrypted deployment-platform environment variable. Do not print keys with echo, debug logs, or exception messages.

​
Limit each token

When you create or edit a token, you can set four limits:
  • Quota matters most. If a token with unlimited quota leaks, you can lose your entire balance. A quota is only a spending cap and doesn’t reserve any of your balance; all tokens draw from the same account balance.
  • IP allowlist takes your server’s public egress IP, as a single address or a CIDR range such as 203.0.113.0/24. Home and office connections change their egress IP, and every call fails once it changes, so use a quota there instead.
  • Allowed models rejects any model not on the list. Use IDs exactly as they appear in the model catalog. For everyday use and testing, leave it empty so switching models doesn’t require a console change.
Use separate tokens for development, testing, and production, and for each service or automation, with names you can recognize, such as prod-image-service. Then you can disable one without affecting the rest. Never embed a server API key in a browser, mobile app, or public client.

​
Keep keys out of these places

  • Repositories: a key committed to Git stays in the history even after you delete the file. Add .env to .gitignore and scan before you commit:
  • Docs, screenshots, and logs: console screenshots, terminal recordings, and error logs can all contain a full key, so use placeholders in examples. Public repositories are scanned by bots around the clock, and leaked keys can be abused quickly.
  • Conversations with AI tools: a key pasted into an AI coding tool usually stays in plain text in local session history and file snapshots. Give AI tools a separate short-lived token with a small quota, delete it when the task is done, and never hand over a production key.

​
Rotate and revoke

Rotate or revoke immediately when:
  • a key appears in Git, logs, screenshots, tickets, or public messages;
  • unexplained requests or balance changes occur;
  • employee, contractor, or system access changes;
  • a dependency, server, or deployment credential is compromised;
  • support or security personnel request action.
Safe rotation sequence:
  1. Create a new key and validate it in a controlled environment.
  2. Update the server-side secret.
  3. Observe calls using the new key.
  4. Revoke the old key.
  5. Review call logs for the affected period.
Your organization should set rotation intervals based on its own risk and audit requirements. The documentation does not promise a universal rotation period or unlimited credit.

​
Investigate unexplained usage

If a token shows calls you don’t recognize:
1

Find where the key went

Search for the key in chat history, repositories and their commit history, and environment variables on deployment and CI platforms. Most unexplained usage turns out to be an old configuration that’s still running.
2

Disable it if you can't find the source

Disable the token in token management. Tokens are independent, so disabling one doesn’t affect the others; create a replacement once you know you need it.
3

Trace the caller in call logs

Filter call logs by the token and look at the models, times, and source IPs. Watch for models you don’t use, calls outside your working hours, and volumes that don’t match your traffic.
4

Lock down the account

Change the account password and limit who can sign in to the console. Staff who only need to check usage don’t need console access.

​
API key vs. system AccessToken

Normal model calls use an API key. Account-level balance or management APIs may use a separate system AccessToken; the two credentials are not interchangeable. See the balance query API for that specific permission boundary.

​
What to provide to support

Provide the account, key creation time, redacted key prefix and suffix, suspicious-call time, model, and error. Do not send the complete API key. If the key was exposed, revoke or rotate it before continuing the investigation.