Management API

Last updated September 29, 2026

Create, change and revoke virtual keys, and read your Gateway usage, from your own scripts, CI jobs or infrastructure-as-code, with a management key. It comes with the Gateway Pro, Scale and Enterprise plans.

Management keys

A management key is a separate kind of credential from a virtual key. It can manage virtual keys but can't call models, and a virtual key can't call the management API. Management keys are prefixed tmk_, stored hashed, and shown to you once, when you create them.

Create one in the Portal:

• For your own account: Gateway → Keys → Management keys. It manages your personal virtual keys.
• For an organization: Organization → Org keys → Management keys. Only owners and admins can create one, and it manages the organization's shared virtual keys.

Choose what each key can do when you create it:

A management key can also have an expiry date and an IP allowlist, set the same way as a virtual key's (see what a virtual key scopes). An account can have up to 10 active management keys. Management keys are only made in the Portal; the API can't create another one.

For an organization:

• Every change a management key makes is recorded in the audit log (Organization → Compliance) under that management key's label.
• When a member is removed, or an owner or admin is made a member, the management keys they created are revoked. Virtual keys those management keys created keep working.

Making requests

The base URL is https://api.temprhq.io/v1/management. Send the management key as a bearer token:

curl https://api.temprhq.io/v1/management/keys \
  -H "Authorization: Bearer tmk_xxxxxxxxxxxxxxxxxxxxxxxx"

Request and response bodies are JSON with snake_case field names. Response timestamps are Unix seconds. expires_at in a request is an ISO 8601 date and time, for example 2027-01-31T00:00:00Z.

Each management key can make 300 requests a minute. Over that, the API answers 429 until the next minute starts.

List keys

GET /v1/management/keys (scope keys:read) returns the account's virtual keys, newest first. The Portal's Playground key and the keys Tempr creates for team members' IDE sessions aren't included.

{
  "object": "list",
  "data": [ { "id": "6f1c2b0e-…", "object": "virtual_key", "label": "ci", … } ],
  "first_id": "6f1c2b0e-…",
  "last_id": "6f1c2b0e-…",
  "has_more": false
}

Create a key

POST /v1/management/keys (scope keys:write) creates a virtual key. label is required; every other field is optional. The response is 201 with the key object, plus the raw key in key. It isn't shown again, so store it now.

curl https://api.temprhq.io/v1/management/keys \
  -H "Authorization: Bearer tmk_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "ci",
    "allowed_models": ["anthropic/claude-sonnet-4-5"],
    "max_budget_usd": 25,
    "rpm_limit": 60,
    "expires_at": "2027-01-31T00:00:00Z"
  }'

{
  "id": "6f1c2b0e-…",
  "object": "virtual_key",
  "label": "ci",
  "masked_key": "tvk_...a1b2",
  "status": "active",
  "created_at": 1790000000,
  "expires_at": 1801353600,
  "last_used_at": null,
  "revoked_at": null,
  "allowed_models": ["anthropic/claude-sonnet-4-5"],
  "allowed_mcp_servers": null,
  "fallback_chains": null,
  "max_budget_usd": 25,
  "rpm_limit": 60,
  "tpm_limit": null,
  "guardrail_mode": null,
  "llm_guardrail_enabled": null,
  "prompt_caching_enabled": null,
  "content_capture_enabled": null,
  "allowed_ips": [],
  "key": "tvk_xxxxxxxxxxxxxxxxxxxxxxxx"
}

A personal account can have up to 3 active virtual keys; an organization has no such limit.

Get a key

GET /v1/management/keys/{id} (scope keys:read) returns one key. status is active, expired or revoked.

Change a key

PATCH /v1/management/keys/{id} (scope keys:write) changes the fields you send and leaves the rest as they are. Send a field as null to clear it, which removes that limit or goes back to the account default. label can be changed but not cleared. A revoked key can't be changed.

curl -X PATCH https://api.temprhq.io/v1/management/keys/6f1c2b0e-… \
  -H "Authorization: Bearer tmk_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "rpm_limit": 120, "max_budget_usd": null }'

Revoke a key

POST /v1/management/keys/{id}/revoke (scope keys:write) revokes a key and returns it. Requests with the key stop authenticating at once. Revoking a key that's already revoked changes nothing.

Key fields

The model and MCP server lists take up to 200 entries each. A field the API doesn't know is an error rather than being ignored, so a typo doesn't pass unnoticed.

Usage

GET /v1/management/usage (scope usage:read) totals the account's Gateway requests over a range of days.

{
  "object": "usage",
  "start": "2026-09-01",
  "end": "2026-09-30",
  "group_by": "model",
  "data": [
    {
      "date": null,
      "key_id": null,
      "model": "anthropic/claude-sonnet-4-5",
      "requests": 1204,
      "errors": 3,
      "prompt_tokens": 5120331,
      "completion_tokens": 402118,
      "cost_usd": 21.3714
    }
  ]
}

Each row fills in the field it's grouped by (date, key_id or model) and leaves the other two null. errors counts requests that got a 4xx or 5xx answer. Usage covers the days your plan keeps logs for.

Errors

Errors use the same shape as the rest of the Gateway API, and param names the field at fault when there is one:

{
  "error": {
    "message": "The RPM limit can't be negative.",
    "type": "invalid_request_error",
    "code": "invalid_value",
    "param": "rpm_limit"
  }
}