title: Key scope and quota probe description: "Read-only probes of every endpoint class your key can reach, plus the subscription object — and the field that does not exist anywhere in it: a per-key spend limit." lead: "Eight GET requests, no generation, no spend. What comes back tells you what your key may do. What does not come back — anywhere in the API — is any way to cap what it may cost. That absence is the whole argument of this site, made empirically rather than asserted." order: 20 kind: experiment family: operations app: key-scope endpoints: "GET /v1/user/subscription · /v1/user · /v1/voices · /v1/models · /v1/pronunciation-dictionaries · /v1/history · /v1/dubbing" state_chips: [unrun] toc: true

{{lab-header}}

{{app}}

Scoped is not bounded

A key can be restricted in the dashboard to the endpoints it needs. A key for a render pipeline needs text-to-speech and voices-read; it does not need dubbing, voice creation, or history — and history is worth thinking about, because it holds the text of everything the account has ever generated.

Scoping limits what a leaked key can do. It does nothing at all to limit how much of the account's quota it can burn {{claim:no-per-key-spend-limit}}. There is no per-key spend limit, no daily window, and nothing that resets faster than the billing cycle {{claim:plan-quotas}}.

That is the difference between this vendor and the sibling one, and it is not a matter of degree. On the sibling provider a key carries a number you chose, and when the spend reaches it the platform refuses — we have the 402 to prove it {{claim:openrouter-402}}. Here, the only refusal comes when the account's month runs out.

How to read the probe

• 200 — the key reaches this class of endpoint. If you did not intend it to, tighten the key in the dashboard and re-run.
• 403 — scoped out, or not on this plan. On a narrowly-scoped key, most rows should be 403; a table of 200s means a key that can do everything, which is what a leak would then be able to do.
• 401 on everything — the key is wrong, revoked, or sent under the wrong header name; auth is xi-api-key, not Authorization {{claim:api-key-shape}}.

The tile that says "none"

The fourth tile in section 3 has no data behind it, because there is no field to read. Every other number on that row comes from GET /v1/user/subscription: characters used, characters allowed, the reset date — all account-level {{claim:plan-quotas}}. The API has no concept of a per-key budget, so a lab cannot show you one.

That is the empirical form of the claim the report↗ makes in prose, and it is why pattern 1↗ is marked unavailable in the comparison↗ rather than merely discouraged.

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).