API keys & limits

Keys are minted on the dashboard (or via POST /me/keys). The full key — br-…, 192 bits of entropy — is shown exactly once and stored only as a hash; the dashboard displays the first 12 characters as a prefix. Up to 5 active keys per org in beta.

Tiers: trial vs standard

	Trial	Standard
When you get it	Default for a new org	Once the org has made a payment or has positive balance (the ₹100 signup credit counts)
Key prefix	`br-trial-…`	`br-…`
Rate limit	60 req/min (hard cap)	None by default; set your own
Daily limit	200 req/day (hard cap)	None by default; set your own
Billing	Free	Debited from prepaid credits per request
Monthly ₹ budget	—	Optional per-key cap

Standard keys are gated on credits: with a zero or negative balance, requests fail with insufficient_credits (HTTP 402) until you top up.

Creating a key

From the dashboard, or:

POST /me/keys
{ "name": "prod-backend", "budget_inr": 500, "expires_days": 90 }

→ { "key": "br-...", "tier": "standard", "budget_inr": 500, "expires_days": 90 }

name — must be unique among your active keys.
budget_inr — optional monthly spend cap in ₹ (see below).
expires_days — optional auto-expiry, 1–365 days.

Per-key limits

Three independent caps, all editable per key on the dashboard (PATCH /me/keys/:id), all enforced durably and reckoned in IST:

Limit	Window	On breach
`rpm_limit`	Rolling minute	429 `rate_limit_exceeded`
`daily_limit`	IST calendar day (resets midnight IST)	429 `daily_limit_reached`
`monthly_budget` (₹)	IST calendar month	429 `budget_exceeded`

On top of these, the gateway applies a global 120 requests/min per key. Limit and revocation changes propagate within 60 seconds (key records are cached that long).

Monthly ₹ budgets

A budget caps what one key can spend per calendar month — give a side project ₹200/month and stop worrying about it. Spend is recorded after each response (cost is only known once token counts are), so a single in-flight request can land marginally over the cap; the next request is blocked. The dashboard shows spend-to-date against budget per key, and GET /me/keys returns it as spent_month alongside monthly_budget.

Revoking

DELETE /me/keys/:id   →   { "revoked": true }

Revocation is permanent and effective within 60 seconds everywhere.

Scopes & ephemeral keys for agents

Keys minted by humans have full scope: inference plus the management tools on the MCP server. Through MCP, an agent holding a full-scope key can mint ephemeral keys — short-lived (1–168 hours), inference-only, daily-capped (up to 1,000 req/day) — to hand to sub-agents or untrusted code without exposing the org key. Ephemeral keys cannot manage keys, BYOK, or billing.