# AI keys

Create Router IA keys with a spending cap, a token shown only once, limits for new companies, revocation and reactivation.

Source: https://ardumaker.com/en/docs/claves-ia/

- Category: AI and agents
- Status: Available
- Requirements: Being a company admin to create, revoke or reactivate; An active payment method in the company; At least 20 EUR of balance, and enough balance to cover the requested cap
- MCP tools (Read only): `listar_claves_router_ia`, `ver_clave_router_ia`
- MCP tools (Write or modify): `crear_clave_router_ia`, `revocar_clave_router_ia`, `reactivar_clave_router_ia`, `crear_token_search_api`, `revocar_token_search_api`, `reactivar_token_search_api`

## What can you do with it?

- Create [Router IA](https://ardumaker.com/en/docs/router-ia) keys with a name, a spending cap in USD and a cap reset period (`daily`, `weekly` or `monthly`).
- Revoke a key: it stops working on OpenRouter and the pending spending is recorded.
- Reactivate a revoked key.
- List keys and see their usage without ever exposing the token.

## When should you use it?

- One key per application or environment, to split spending and be able to cut one without affecting the others.
- When a token leaked: revoke it and create a new one.
- To limit how much an integration can spend per day, week or month.

## How does it work in ArduMaker?

### Create

1. It is checked that the requester is a company admin and that the company has an active payment method.
2. The balance is checked: at least 20 EUR, and enough to cover the requested cap.
3. If the company is new (less than 7 days old or without an authorized payment): at most 5 active keys, a daily cap of up to 30 USD and daily reset only.
4. The key is created on OpenRouter. Without `limit`, it starts with a 30 USD cap that resets every day.
5. The answer carries the full token **only once**. It is never shown again over MCP or in listings.

> **PRECAUCION:** `limit` is the key's **spending cap**, not a page size. Sending 50 creates a key that can spend 50 USD per period.

### Revoke and reactivate

- Revoking syncs usage (to record what is pending), disables the key on OpenRouter and marks it as deleted. The row is not removed.
- Reactivating enables it again on OpenRouter and clears the balance-pause flag.
- A key paused for negative balance or identity verification is not revoked: it reactivates by itself when the cause is solved.

[Search API](https://ardumaker.com/en/docs/search-api) tokens follow similar rules (admin, payment method, 20 EUR balance, token visible once, revoke and reactivate), but have no spending cap of their own.

## What actually changes?

- On OpenRouter: the key, with a name that includes the company and the chosen name.
- In ArduMaker: the key is linked to a company service; revoking it removes that service.
- In the company history: consumption, as it syncs.

## Diagram

**Key lifecycle**

```text
Created (token visible once)
  ↓
Active (spends up to its cap per period)
  ↓
Paused (negative balance or verification; comes back by itself)
  ↓
Revoked (disabled; can be reactivated)
```

## Expected result

- `crear_clave_router_ia` returns `id`, `name`, `api_key` (the token) and a warning to save it now.
- `ver_clave_router_ia` returns usage, cap, remaining and reset; with admin rights, the spending detail too.
- A revoked key no longer shows as active and OpenRouter rejects it.

## Errors and troubleshooting

| Answer | Cause | What to do |
| --- | --- | --- |
| 403 | Only a company admin creates, revokes or reactivates | Ask an admin |
| 400 no payment method | The company has no active payment method | Add one |
| 400 balance | Less than 20 EUR, or the requested cap exceeds the balance | Top up or ask for a lower cap |
| 400 new company | More than 5 keys, a daily cap above 30 USD or a non-daily reset | Lifted after 7 days and one authorized payment |
| 400 already revoked / already active | The key was already in that state | Nothing to do |
| OpenRouter error | OpenRouter rejected or did not answer | Retry later |

> **PELIGRO:** `crear_clave_router_ia` is not idempotent by itself: a retry without the same `idempotency_key` creates a second key. With the same idempotency key, the original result (including the token) is recovered for 24 hours.

## MCP access

Yes, in the `/mcp` and `/mcp/infra` profiles.

| Tool | Type | Notes |
| --- | --- | --- |
| `listar_claves_router_ia`, `ver_clave_router_ia` | Read | Never return the token |
| `crear_clave_router_ia` | Write | Admin; returns the token once; accepts `idempotency_key` |
| `revocar_clave_router_ia` | Destructive, reversible | Admin |
| `reactivar_clave_router_ia` | Write | Admin |
| `crear_token_search_api`, `revocar_token_search_api`, `reactivar_token_search_api` | Write | Search API tokens, same admin rules |

The token is sensitive data in the answer: the agent must hand it to its human and not publish it. Reference at [/mcp/docs](https://ardumaker.com/en/mcp/docs) and examples at [/mcp/ia](https://ardumaker.com/en/mcp/ia).

## Related features

- [Router IA](https://ardumaker.com/en/docs/router-ia/)
- [Search API](https://ardumaker.com/en/docs/search-api/)
- [Balance per company](https://ardumaker.com/en/docs/saldo-por-empresa/)
- [MCP server](https://ardumaker.com/en/docs/servidor-mcp/)