Control and cost
Access rules
Allow or block models, providers, price ranges and IP addresses for an API key, a member or a team. How rules at different levels combine.
Access rules decide what a key may use. Open a key's menu and choose Access rules; members and teams have the same editor under Team.
Each rule is Allow only or Block, and applies to one of:
| Applies to | Example |
|---|---|
| Models | Allow only claude-haiku-5-5 and gpt-6-luna. |
| Providers | Block xai. |
| Pricing | Allow only models up to $1 input and $5 output per million tokens, or only free or only paid models. |
| IP addresses | Allow only 203.0.113.0/24 (IPv4 or IPv6 CIDR). Enterprise plan. |
A request must pass every active rule. Pause a rule to switch it off without deleting it.
How levels combine
Rules can be set on a key, on the member who owns it, and on that member's team.
- Block rules from every level apply.
- Allow only lists must all agree: a model must be allowed at every level that has an allow list. So a key can narrow what its member or team may use, but never widen it.
What the caller sees
| Rule | Response |
|---|---|
| Model, provider or pricing | 403 model_not_allowed |
| IP address | 403 permission_error: "Requests from this IP address aren't allowed for this API key." |
With auto, rules narrow the models auto chooses from instead of refusing the request.
Who can change them
Owners, admins and project admins manage key rules; a key's creator can't change the rules on it unless they're one of these. Member and team rules are set by owners and admins.
Checked against the gateway on 31 October 2026. Something wrong or missing? Tell us.