Developers
API keys & limits
Create, name, limit and revoke wallet-owned API keys; how many keys each wallet gets and the per-key rate limit.
On this page
An API key belongs to the wallet that created it. Everything it spends is billed to that wallet. You manage keys on tacita.chat → Developers, signed in with your wallet. Keys can't create or manage other keys.
Format#
A key is tc_live_ followed by 43 letters and digits, for example tc_live_7Gh2kLmN….
- It is shown once, when you create it.
- After that you only see its prefix,
tc_live_7Gh2kLmN. - We store only a hash of the key, so nobody can recover a lost key. Create a new one instead.
Send it as a bearer token:
Authorization: Bearer tc_live_...
What you can set#
| Setting | Notes |
|---|---|
| Name | Up to 64 characters, e.g. "my-bot". |
| Monthly spend limit | Optional cap in USD per calendar month (UTC). When it's reached, requests fail with 402 spend_limit_reached until the 1st of next month. Remove it any time. |
| Revoke | Takes effect immediately. Revoked keys stay listed, marked revoked. |
For each key the page shows its name, prefix, creation date, limit and this month's spend. Per-request history doesn't exist: we don't keep it.
How many keys#
Holding the token gives a few more keys as a small bonus. Everything else about the API is the same for everyone.
| Tier | Active keys |
|---|---|
| No tier | 1 |
| Tier 1 | 2 |
| Tier 2 | 3 |
| Tier 3 | 5 |
| Tier 4 | 10 |
See Tiers for how tiers work. Revoked keys don't count toward the limit.
Rate limits#
Each key can make 120 requests per minute. Over that, you get 429 rate_limited with a Retry-After header. The OpenAI SDKs retry automatically.
Security tips#
- Keep keys out of front-end code and public repos. Use environment variables or a secrets manager.
- Give each app its own key with its own spend limit, so one leak can't drain your credits.
- Revoke any key you think has leaked, then create a new one.