orl api-keys create
Create an API key (returns the plaintext once) (needs `orl auth login`), part of the orl CLI for OpenRelay GPU VMs, pods, batches and billing.
orl api-keys create --name <name>Returns the new key's plaintext secret, which is shown only in this response, with its id, prefix, organization id, and any permissions or budget. With permissions enabled, only a signed-in session creates keys, and a new key belongs to the organization (kind org), so it keeps working if its creator leaves; personal and service kinds are refused, except dashboard playground keys, which are always personal. Its permissions come from template or permissions and can never exceed the creator's own access (403 ESCALATION_REFUSED). scopes still works and maps to the key's ceiling. budget caps what the new key may spend on inference per period. A key that carries a budget cannot create keys (403 FORBIDDEN), so it cannot mint itself one without a budget.
Flags
| Flag | Type | Required | |
|---|---|---|---|
--budget | json | no | A spend budget for the key. The inference API refuses the key's requests with 402 key_budget_exceeded when its spend in the period plus an estimate of the request's cost would pass the limit, and its new batches once the spend reaches the limit. The estimate is not a bound and nothing is reserved: a request can cost more than its estimate (its prompt size is estimated, and cache writes are not priced into it), requests and batches already running finish, and requests sent at the same time can each pass the limit. |
--expires-in-seconds | int64 | no | Optional server-side expiry, in seconds from now. When set (and > 0) the key stops authenticating after this many seconds, capping the leak window regardless of any client-side cleanup. Omitted or <= 0 means the key never expires (the default). |
--name | string | yes | |
--scopes | []string | no | Supported values: clusters:read, clusters:write, vms:read, vms:write, inference, and inference:endpoint:<id> for an enabled dedicated endpoint owned by the organization. An endpoint scope also adds the inference scope when it is omitted. clusters:read grants read access to the organization's resources, including VMs and pods, and clusters:write grants write access, including VM restart and API key creation. vms:read and vms:write are accepted for compatibility but grant nothing on their own, so each must be requested together with clusters:read or clusters:write respectively; a request with one but not the other returns 400. With permissions enabled, a session's request with scopes creates an organization key whose ceiling the scopes map to. |
--key-file | string | no | write the plaintext key to this new file (mode 0600) instead of printing it |
--budget-usd | string | no | cap the key's inference spend per --budget-period, in dollars (50, or 2.50); writes --budget |
--budget-period | lifetime, daily, monthly | no | the budget's period with --budget-usd: lifetime, the default, never resets; daily and monthly reset at 00:00 UTC. |
--body | string | no | a JSON object of request body fields, merged under any of this command's own flags that are also set, e.g. {"key":"value"} |
--body-file | string | no | read the --body JSON object from a file (- for stdin) |
This wraps the createOrgApiKey API operation.
orl api
Call a control-plane or inference-host path with the current credentials, part of the orl CLI for OpenRelay GPU VMs, pods, batches and billing.
orl api-keys delete
Revoke an API key (needs `orl auth login`) (asks for confirmation; --yes to skip), part of the orl CLI for OpenRelay GPU VMs, pods, batches and billing.