Token Management - 老张API

Token Overview

API Token (API Key) is your credential for calling Laozhang API. Like a password, it’s used to verify your identity and record usage.

Security AlertAPI Token is like your account password. If leaked, others can use your quota. Please keep it safe!

Create Token

Standard Token

Visit Laozhang API Console and log in

Enter Token Management

Click “API Keys” in the left menu

Create New Token

Click “Create New Token” button

Configure Token

Fill in token information:

Token Name: For identifying token purpose (e.g., “Production Environment”, “Testing”)
Billing Method: Choose billing method
- Usage-based billing (pay per token)
- Pay-per-use (pay per request)
Permissions: Set API permissions (optional)
Expiration Time: Set token validity period (optional)

Save Token

Click “Create” button and immediately save the generated Token

Important: Token only displays once. If lost, need to recreate.

Special Purpose Tokens

Usage-based Billing Token
Pay-per-use Token
Read-only Token
Temporary Token

Suitable For:

High-frequency API calls
Chat applications
Text processing
Code generation

Billing Method:

Billed by tokens consumed
More economical for high usage
Support all text models

How to Create: Select “Usage-based billing” when creating token

Manage Tokens

View Token List

View all your tokens in console:

Token Name	Created	Last Used	Status	Operations
Production	2024-01-01	2 minutes ago	🟢 Active	Edit \| Revoke
Testing	2024-01-05	Yesterday	🟢 Active	Edit \| Revoke
Demo	2024-01-10	Never	🟡 Not Used	Edit \| Revoke
Old Token	2023-12-01	Last month	🔴 Revoked	Delete

Edit Token

Can modify token configuration:

Click Edit

Click “Edit” button next to token

Modify Configuration

Modifiable items:

Token name
Permissions
Expiration time
Usage limits

Save Changes

Click “Save” button

Cannot modify the token value itself. If need new Token value, must recreate.

Revoke Token

When need to invalidate a Token:

Select Token

Find token to revoke in token list

Click Revoke

Click “Revoke” button

Confirm Operation

Confirm revocation in popup dialog

After revocation, all applications using this Token will fail. Ensure alternatives are prepared.

Rotate Tokens

Regularly rotating Tokens enhances security:

Create New Token

Create new token as replacement

Update Application

Update all applications to use new Token

Test Verification

Confirm new Token works properly

Revoke Old Token

Revoke old Token

Recommended Rotation Frequency

Production environment: Every 3 months
Development environment: Every 6 months
Temporary Token: Set expiration time

Security Best Practices

1. Token Storage

# ❌ Bad Practice: Hardcode in code
api_key = "sk-rHcKJkgO4y3e5CTdDd1a..."

# ✅ Good Practice: Use environment variables
import os
api_key = os.getenv("LAOZHANG_API_KEY")

# ✅ Good Practice: Use configuration files
import json
with open('config.json') as f:
    config = json.load(f)
    api_key = config['api_key']

// ❌ Bad Practice: Hardcode in code
const apiKey = "sk-rHcKJkgO4y3e5CTdDd1a...";

// ✅ Good Practice: Use environment variables
const apiKey = process.env.LAOZHANG_API_KEY;

// ✅ Good Practice: Use dotenv
require('dotenv').config();
const apiKey = process.env.LAOZHANG_API_KEY;

# Set environment variable
export LAOZHANG_API_KEY="your_api_key"

# Or add to .bashrc/.zshrc
echo 'export LAOZHANG_API_KEY="your_api_key"' >> ~/.bashrc

2. Version Control

Never Commit API KeyNever commit API Keys to version control systems (Git, SVN, etc.)

# .gitignore file
.env
config.json
secrets/
*.key

3. Permission Control

Set minimum necessary permissions:

Scenario	Recommended Permissions
Production Environment	Full permissions, strict access control
Development Environment	Full permissions, local use only
Testing Environment	Limited permissions, low quotas
Demo Applications	Read-only or limited calls
Third-party Integration	Minimum necessary permissions

4. IP Whitelist

Limit Token to specific IP addresses:

Enable IP Restrictions

Edit Token settings and enable “IP Whitelist”

Add Allowed IPs

Add IPs allowed to use this Token:

Single IP: 192.168.1.100
IP Range: 192.168.1.0/24
Multiple IPs: Add multiple rules

Test Verification

Test from allowed IPs to ensure normal access

5. Usage Monitoring

Regularly check Token usage:

import requests

# Query Token usage
response = requests.get(
    "https://api2.laozhang.ai/v1/usage",
    headers={"Authorization": "Bearer your_api_key"}
)

usage = response.json()
print(f"Today's usage: {usage['today_usage']}")
print(f"This month's usage: {usage['month_usage']}")

# Set alert threshold
if usage['today_usage'] > DAILY_LIMIT:
    send_alert("Usage abnormal!")

Token Leakage Handling

If Token Leaked

Immediately Revoke

Immediately revoke leaked Token in console

Check Usage Records

Check recent usage records for unusual activities

Assess Impact

Evaluate potential losses:

Unusual API calls?
Abnormal cost increases?
Sensitive data leaks?

Create New Token

Create new replacement Token

Update Applications

Update all applications to use new Token

Contact Support

If unusual usage found, contact support:

Email: hi@laozhang.ai
Request balance freeze or refund
Report security incident

Prevent Leakage

Prevention Measures

✅ Use environment variables
✅ Add keys to .gitignore
✅ Do not share keys in chat/email
✅ Use different keys for different environments
✅ Enable IP whitelist
✅ Regularly rotate keys
✅ Monitor usage logs
✅ Set usage limits

Programmatic Management

Create Token via API

import requests

# Create new Token
response = requests.post(
    "https://api2.laozhang.ai/v1/api-keys",
    headers={
        "Authorization": "Bearer your_admin_token",
        "Content-Type": "application/json"
    },
    json={
        "name": "New Production Token",
        "billing_method": "usage_based",
        "permissions": ["chat", "completion"],
        "expires_at": "2025-12-31T23:59:59Z"
    }
)

new_token = response.json()
print(f"New Token: {new_token['key']}")

List Tokens

# Get all Tokens
response = requests.get(
    "https://api2.laozhang.ai/v1/api-keys",
    headers={"Authorization": "Bearer your_admin_token"}
)

tokens = response.json()
for token in tokens['data']:
    print(f"Name: {token['name']}, Status: {token['status']}")

Revoke Token

# Revoke specified Token
token_id = "key_123456"
response = requests.delete(
    f"https://api2.laozhang.ai/v1/api-keys/{token_id}",
    headers={"Authorization": "Bearer your_admin_token"}
)

if response.status_code == 200:
    print("Token successfully revoked")

Common Issues

Error: "Invalid API Key"

Possible Causes:

Token Incorrect
- Check for extra spaces or newlines when copying
- Ensure complete Token copied
- Check for character confusion (0/O, 1/l, etc.)
Token Revoked
- Check Token status in console
- May have been manually revoked
- May have reached expiration time
Token Expired
- Check Token expiration time
- Recreate if expired

Solutions:

# Test Token validity
import requests

response = requests.get(
    "https://api2.laozhang.ai/v1/models",
    headers={"Authorization": f"Bearer {api_key}"}
)

if response.status_code == 200:
    print("Token valid")
else:
    print(f"Token invalid: {response.json()}")

Can one account create multiple Tokens?

Yes, can create multiple TokensUse Cases:

Different environments (development/testing/production)
Different projects
Different billing methods
Different permission levels

Limits:

Standard users: Up to 10 Tokens
Professional users: Up to 50 Tokens
Enterprise users: Unlimited

Can billing method be changed after Token creation?

Cannot directly change billing methodSolutions:

Create new Token with desired billing method
Update applications to use new Token
Revoke old Token

Note:

Usage records remain independent
Balance is shared (same account)

How to set usage limits for Token?

Set Usage Limits:

Edit Token

Click “Edit” next to Token

Set Limits

Configure:

Daily limit (calls or amount)
Monthly limit
Single request maximum tokens
Allowed models

Save Settings

Click “Save” button

Example:

{
  "daily_limit": {
    "requests": 1000,
    "amount": 10
  },
  "monthly_limit": {
    "amount": 300
  },
  "max_tokens_per_request": 4000,
  "allowed_models": ["gpt-3.5-turbo", "gpt-4"]
}

What to do after forgetting Token?

Cannot Retrieve Lost TokenToken only displays once when created, cannot be retrieved later for security.Solutions:

Create new Token as replacement
Update all applications to use new Token
Revoke old Token (optional)

Prevention:

Immediately save Token after creation
Use password manager to store
Save to secure configuration management system

Best Practices

1. Environment Isolation

Use different Tokens for different environments:

Development Environment
  ├── Token: dev_token
  ├── Budget: $10/month
  └── Models: gpt-3.5-turbo only

Testing Environment
  ├── Token: test_token
  ├── Budget: $50/month
  └── Models: All models

Production Environment
  ├── Token: prod_token
  ├── Budget: $500/month
  ├── IP Whitelist: Server IPs only
  └── Monitoring: Alert enabled

2. Token Naming

Use clear naming conventions:

[Environment]-[Project]-[Purpose]-[Date]

Examples:
- prod-webapp-api-2024-01
- dev-mobile-testing-2024-01
- test-integration-demo-2024-01

3. Regular Audits

Establish regular audit mechanisms:

Weekly:
- Check Token usage
- Review unusual activities
- Verify IP whitelist

Monthly:
- Review all Tokens necessity
- Revoke unused Tokens
- Update Token permissions
- Rotate high-risk Tokens

Quarterly:
- Comprehensive security audit
- Update security policies
- Staff security training

Insufficient Balance - Handle balance issues
Usage Logs - View API usage records
Data Security - Understand data protection
API Reference - View API documentation

​Token Overview

​Create Token

​Standard Token

​Special Purpose Tokens

​Manage Tokens

​View Token List

​Edit Token

​Revoke Token

​Rotate Tokens

​Security Best Practices

​1. Token Storage

​2. Version Control

​3. Permission Control

​4. IP Whitelist

​5. Usage Monitoring

​Token Leakage Handling

​If Token Leaked

​Prevent Leakage

​Programmatic Management

​Create Token via API

​List Tokens

​Revoke Token

​Common Issues

​Best Practices

​1. Environment Isolation

​2. Token Naming

​3. Regular Audits

​Related Resources

Token Overview

Create Token

Standard Token

Special Purpose Tokens

Manage Tokens

View Token List

Edit Token

Revoke Token

Rotate Tokens

Security Best Practices

1. Token Storage

2. Version Control

3. Permission Control

4. IP Whitelist

5. Usage Monitoring

Token Leakage Handling

If Token Leaked

Prevent Leakage

Programmatic Management

Create Token via API

List Tokens

Revoke Token

Common Issues

Best Practices

1. Environment Isolation

2. Token Naming

3. Regular Audits

Related Resources