Self-serve API keys done right: rotation, budgets and rate limits

Why self-serve API key management matters

When you integrate an LLM API into an application, the API key is the single credential that unlocks access. If that key leaks—through a commit, a client-side bundle, or a misconfigured environment variable—an attacker can run up costs or extract model responses at your expense.

Self-serve API providers like TokenShop give you direct control over key creation, rotation, and spending limits. But that control only helps if you know how to use it. This article covers three practical pillars of API key management: rotation schedules, budget enforcement, and rate limit configuration. These patterns apply whether you're building a prototype or a production service.

Rotation: keeping keys fresh

Static API keys that never change are a liability. The longer a key exists, the more opportunities there are for it to be exposed. A rotation policy ensures that even if a key leaks, the window of vulnerability is short.

When to rotate

• After a suspected leak — immediately generate a new key and invalidate the old one.
• On a regular schedule — every 30-90 days for production keys, more frequently for development or shared keys.
• When a team member leaves — rotate any keys that individual had access to.

How to rotate with TokenShop

TokenShop's API uses standard HTTP endpoints for key management. To rotate, you create a new key and then delete the old one.

# Create a new API key (replace YOUR_ADMIN_KEY with your actual key)
curl -X POST https://tokshop.xyz/v1/api-keys \
  -H "Authorization: Bearer YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label": "production-v2", "permissions": ["chat:write"]}'

# Response includes the new key
# {"id": "key_abc123", "key": "tsk_...", "label": "production-v2"}

# Delete the old key
curl -X DELETE https://tokshop.xyz/v1/api-keys/key_old_key_id \
  -H "Authorization: Bearer YOUR_ADMIN_KEY"

In code, you can automate this with a simple Python script:

import requests, os

BASE = "https://tokshop.xyz/v1"
HEADERS = {"Authorization": f"Bearer {os.environ['ADMIN_KEY']}"}

# Create new key
resp = requests.post(f"{BASE}/api-keys", headers=HEADERS, json={
    "label": "production-v3",
    "permissions": ["chat:write"]
})
new_key = resp.json()["key"]
print(f"New key: {new_key}")

# Delete old key
old_key_id = "key_old_key_id"
requests.delete(f"{BASE}/api-keys/{old_key_id}", headers=HEADERS)

Important: After rotation, update your application's environment variables or secret store. A rolling deployment where both old and new keys are valid for a short overlap period prevents downtime.

Budget controls: preventing cost surprises

Unbounded API access is risky. A bug in your code, a malicious user, or a sudden traffic spike can drain your prepaid balance. TokenShop uses a prepaid micro-USD ledger: when your balance drops below $0.001, the API returns HTTP 402 (Payment Required). This hard stop protects you from unexpected charges, but it's better to set soft limits before you hit that wall.

Setting per-key spending caps

If TokenShop's API supports per-key spending limits (check the docs for the latest), you can assign a maximum spend per key. This is useful when:

• You give a key to a specific service or team.
• You're running experiments and want to cap costs.
• You have a key used by a client-side application.

# Create a key with a $10 spending limit
curl -X POST https://tokshop.xyz/v1/api-keys \
  -H "Authorization: Bearer YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label": "staging", "spending_limit_usd": 10.00}'

Budget monitoring patterns

Track your spending programmatically:

import requests

resp = requests.get("https://tokshop.xyz/v1/account/usage", 
                    headers={"Authorization": f"Bearer {os.environ['API_KEY']}"})
usage = resp.json()
print(f"Current spend: ${usage['total_spent_usd']:.4f}")
print(f"Remaining balance: ${usage['balance_usd']:.4f}")

For production, set up alerts when spend reaches thresholds (e.g., 50%, 80%, 90% of your monthly budget). A simple cron job or serverless function that checks the usage endpoint and sends a Slack or email notification works well.

Rate limits: protecting your application and the API

Rate limits prevent a single client from overwhelming the API or your application. They're essential for:

• Fair usage among multiple services sharing one key.
• Cost control by limiting the volume of requests.
• Stability by preventing cascading failures during traffic spikes.

Client-side rate limiting

The simplest approach is to implement rate limiting in your application code. Here's a basic token bucket implementation in Python:

import time, threading

class TokenBucket:
    def __init__(self, rate_per_second, burst_size):
        self.rate = rate_per_second
        self.burst = burst_size
        self.tokens = burst_size
        self.last_refill = time.monotonic()
        self.lock = threading.Lock()
    
    def consume(self, tokens=1):
        with self.lock:
            now = time.monotonic()
            elapsed = now - self.last_refill
            self.tokens = min(self.burst, self.tokens + elapsed * self.rate)
            self.last_refill = now
            
            if self.tokens < tokens:
                return False
            self.tokens -= tokens
            return True

# Usage: limit to 10 requests per second, burst up to 20
bucket = TokenBucket(10, 20)

def make_request(prompt):
    if not bucket.consume():
        raise Exception("Rate limit exceeded, please wait")
    # Proceed with API call
    response = requests.post("https://tokshop.xyz/v1/chat/completions", 
                             headers={"Authorization": f"Bearer {API_KEY}"},
                             json={"model": "alibaba/qwen-3-32b", "messages": [{"role": "user", "content": prompt}]})
    return response.json()

Handling API-side rate limits

TokenShop may impose its own rate limits on the API. When you receive a 429 Too Many Requests response, implement exponential backoff:

import time, requests

def call_with_retry(url, headers, payload, max_retries=5):
    for attempt in range(max_retries):
        resp = requests.post(url, headers=headers, json=payload)
        if resp.status_code == 429:
            wait = min(2 ** attempt + 0.5 * attempt, 30)  # cap at 30 seconds
            time.sleep(wait)
            continue
        resp.raise_for_status()
        return resp.json()
    raise Exception("Max retries exceeded")

Putting it all together: a practical workflow

Here's a complete pattern for managing keys in a production application:

1. Provision keys per environment — separate keys for development, staging, and production.
2. Set spending limits — $5 for dev, $50 for staging, a monthly cap for production.
3. Implement client-side rate limiting — token bucket with conservative limits.
4. Automate rotation — a weekly cron job that creates new keys, deploys them, and deletes old ones.
5. Monitor and alert — check usage daily; alert if spending exceeds 80% of the cap.

For pricing details on the models available through TokenShop, see the pricing page. The current lineup includes Qwen3 32B at $0.3/$0.9 per million tokens (input/output), DeepSeek V3.2 at $0.4/$0.8, and GLM-4.6 at $0.8/$2.4.

Conclusion

Self-serve API key management doesn't have to be complex. By implementing key rotation, budget controls, and rate limits, you protect your application from leaks, cost overruns, and instability. Start with the basics—per-key spending caps and a simple rotation schedule—then add rate limiting and automated monitoring as your usage grows. TokenShop's OpenAI-compatible API and straightforward key management endpoints make these patterns easy to implement with standard HTTP requests and any programming language you prefer.