AI keys
Create Router IA keys with a spending cap, a token shown only once, limits for new companies, revocation and reactivation.
- Category: AI and agents
- Status: Available
- Requirements: Being a company admin to create, revoke or reactivate; An active payment method in the company; At least 20 EUR of balance, and enough balance to cover the requested cap
- MCP tools (Read only):
listar_claves_router_ia,ver_clave_router_ia - MCP tools (Write or modify):
crear_clave_router_ia,revocar_clave_router_ia,reactivar_clave_router_ia,crear_token_search_api,revocar_token_search_api,reactivar_token_search_api
What can you do with it?
- Create Router IA keys with a name, a spending cap in USD and a cap reset period (
daily,weeklyormonthly). - Revoke a key: it stops working on OpenRouter and the pending spending is recorded.
- Reactivate a revoked key.
- List keys and see their usage without ever exposing the token.
When should you use it?
- One key per application or environment, to split spending and be able to cut one without affecting the others.
- When a token leaked: revoke it and create a new one.
- To limit how much an integration can spend per day, week or month.
How does it work in ArduMaker?
Create
- It is checked that the requester is a company admin and that the company has an active payment method.
- The balance is checked: at least 20 EUR, and enough to cover the requested cap.
- If the company is new (less than 7 days old or without an authorized payment): at most 5 active keys, a daily cap of up to 30 USD and daily reset only.
- The key is created on OpenRouter. Without
limit, it starts with a 30 USD cap that resets every day. - The answer carries the full token only once. It is never shown again over MCP or in listings.
Revoke and reactivate
- Revoking syncs usage (to record what is pending), disables the key on OpenRouter and marks it as deleted. The row is not removed.
- Reactivating enables it again on OpenRouter and clears the balance-pause flag.
- A key paused for negative balance or identity verification is not revoked: it reactivates by itself when the cause is solved.
Search API tokens follow similar rules (admin, payment method, 20 EUR balance, token visible once, revoke and reactivate), but have no spending cap of their own.
What actually changes?
- On OpenRouter: the key, with a name that includes the company and the chosen name.
- In ArduMaker: the key is linked to a company service; revoking it removes that service.
- In the company history: consumption, as it syncs.
Diagram
- Created: token visible once
- Active: spends up to its cap per period
- Paused: negative balance or verification; comes back by itself
- Revoked: disabled; can be reactivated
Expected result
crear_clave_router_iareturnsid,name,api_key(the token) and a warning to save it now.ver_clave_router_iareturns usage, cap, remaining and reset; with admin rights, the spending detail too.- A revoked key no longer shows as active and OpenRouter rejects it.
Errors and troubleshooting
| Answer | Cause | What to do |
|---|---|---|
| 403 | Only a company admin creates, revokes or reactivates | Ask an admin |
| 400 no payment method | The company has no active payment method | Add one |
| 400 balance | Less than 20 EUR, or the requested cap exceeds the balance | Top up or ask for a lower cap |
| 400 new company | More than 5 keys, a daily cap above 30 USD or a non-daily reset | Lifted after 7 days and one authorized payment |
| 400 already revoked / already active | The key was already in that state | Nothing to do |
| OpenRouter error | OpenRouter rejected or did not answer | Retry later |
MCP access
Yes, in the /mcp and /mcp/infra profiles.
| Tool | Type | Notes |
|---|---|---|
listar_claves_router_ia, ver_clave_router_ia | Read | Never return the token |
crear_clave_router_ia | Write | Admin; returns the token once; accepts idempotency_key |
revocar_clave_router_ia | Destructive, reversible | Admin |
reactivar_clave_router_ia | Write | Admin |
crear_token_search_api, revocar_token_search_api, reactivar_token_search_api | Write | Search API tokens, same admin rules |
The token is sensitive data in the answer: the agent must hand it to its human and not publish it. Reference at /mcp/docs and examples at /mcp/ia.