What is a management key?

A normal API key calls models. A management key creates and controls normal API keys, and cannot call a model at all. It is a remote control for the Keys page, for code instead of clicks.

Runtime key (sk-rr-v1-...): goes in your app, sends chat completions, spends your balance, obeys its budget cap. This is the key everyone has.

Management key (sk-rr-mgmt-...): never touches a model. It talks only to the Provisioning API, where it can create runtime keys, set their limits, disable them and revoke them. Sent to a chat endpoint it is rejected, and a runtime key sent to the Provisioning API is rejected the same way. Losing one can cost you key hygiene, never inference money.

One kind of customer: someone building a product on top of Rapid Router that has its own users. Say you run a coding assistant with 200 subscribers and you want each subscriber isolated on their own key with their own $10 monthly cap. Creating 200 keys by hand in the dashboard, and revoking one every time someone churns, does not scale. With a management key your backend does it:

new signup → POST /provisioning/keys with a name and a limit → customer churns → DELETE /provisioning/keys/:id → done. Rotation, suspension for non-payment, per-customer spend reporting: all the same pattern.

If you are one developer calling models from your own code, you do not need this. Ignore the section entirely; nothing else on the platform depends on it.

Can: create runtime keys, list them, read one key's live spend against its limit, rename, change limits and model allowlists, disable (reversible) and revoke (permanent). Everything it creates shows up on your Keys page like any other key and spends from the same balance.

Cannot: call any model, read or move your money, create other management keys, touch your account settings, or see key secrets after creation. Like runtime keys, the secret is shown once at creation and we store only a hash.

Open the Keys page, expand "Management keys", create one and copy the secret. Then:

curl https://rapidrouter.ai/api/v1/provisioning/keys -H "Authorization: Bearer sk-rr-mgmt-..." -d '{"name":"customer-1","limit_usd":10,"limit_reset":"monthly"}'

The response contains a brand-new runtime key. Full reference with rotate and disable examples lives in the Provisioning API docs. You can hold up to 5 active management keys, so a rotation bot and a signup service do not have to share one secret.