API keys

For your first key, use Dashboard → API keys after signing in. Once you already have a key, POST /v1/account/keys is also supported for automation.

Account-management API calls require authentication. Use either a dashboard session cookie from the web app or an existing oz_* API key in the Authorization header. Notebook oznb_* tokens cannot manage account resources.

Create key by API

curl https://ozeye.ai/v1/account/keys \
  -H "Authorization: Bearer $OZEYE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "production-app",
    "rate_limit_rpm": 300,
    "credit_limit_eur": 50.00,
    "credit_reset_interval": "monthly"
  }'

Response

{
  "id": "key_uuid",
  "prefix": "oz_abc12345",
  "name": "production-app",
  "rate_limit_rpm": 300,
  "credit_limit_eur": 50.00,
  "credit_reset_interval": "monthly",
  "is_active": true,
  "created_at": "2026-05-07T12:00:00Z",
  "key": "oz_full_secret_shown_once"
}

Request fields

{
  "name": "production-app",
  "rate_limit_rpm": 300,
  "credit_limit_eur": 50.00,
  "credit_reset_interval": "monthly",
  "expires_at": "2027-01-01T00:00:00Z"
}

Supported limits

rate_limit_rpm - optional per-key requests-per-minute limit, 1 to 10000.
credit_limit_eur - optional per-key credit limit.
credit_reset_interval - daily, weekly, or monthly; requires credit_limit_eur.
expires_at - optional RFC3339 timestamp in the future.
Each account can have up to 25 active API keys.

Security best practices

API key secrets are shown once at creation in the key response field.
Keep keys on your server. Do not ship them in frontend code or localStorage.
Use separate keys for development, production, notebooks, and automation.
Set credit limits on keys used by notebooks or scripts.
Revoke compromised keys immediately from the dashboard or DELETE /v1/account/keys/{id}.