Authentication

API keys (for programs)

Pass your key as a bearer token on every AI/service request:

Authorization: Bearer kb_YOUR_KEY

Keys are managed from Dashboard → API Keys. Each key can have:

• Expiry — a date, or "never". Expired keys return 401 key_expired.
• Credit limit — a dollar spend cap for that key. Once reached, requests return 402 key_budget_exhausted even while your plan quota is fine.
• Reset — how often the key's spend counter goes back to zero.
• Models and Services — allow-lists that narrow the key to less than your account can do.
• Account management — whether the key may act on your account itself.
• Disabled — flip off without deleting.

You can hold up to 50 keys.

Credit limit & reset

A credit limit is per key and independent of your plan quota. Leave it blank for no limit. The Reset setting decides when the key's spend counter returns to zero:

Scoping a key: models & services

By default a key can reach every model and service your plans cover. Narrow it when you hand a key to an app, a teammate, or CI:

• Models — pick a set, and anything else returns 403 model_not_allowed_for_key.
• Services — pick a set, and calling any other service returns 403 service_not_allowed_for_key. Chat / AI completions is always available.

Scoping only ever subtracts: a key can never do more than your plans already allow, so a model outside your plans still returns 403 model_not_in_plan.

When the Documents service is in scope the key also takes a document-key filter, which limits which stored documents it may touch.

Account management

Service calls (chat, images, speech, search, documents…) work with any key. Endpoints that manage the account — plans, billing, keys themselves, and admin actions when your account is an admin — require a key with Account management switched on; without it they return 403 key_not_authorized.

Leave it off for keys you ship inside an app. A key that carries it can do anything you can do in the dashboard, so treat it like your password.

What can this key do? GET /api/v1/key-info

A key can introspect itself — useful when an app is handed a key and wants to fail early:

curl https://khabot.com/api/v1/key-info \
  -H "Authorization: Bearer kb_YOUR_KEY"

It reports the key's own limits: its credit limit and spend, when that spend next resets, its model and service allow-lists (null = unrestricted), its document filter, and whether account management is on.