Restricting models

Updated 8 November 2026

A key can be limited to some models, so a leaked or misused key cannot run up a bill on the most expensive one. Rules are exact ids (claude-sonnet-5), prefixes (claude-*), or makers (vendor:anthropic). An end user can be narrowed further, never widened past their key.

# A key that may only call Claude models:
curl https://wekoya-api.wekoya.tech/v1/keys \
  -H "Authorization: Bearer $WEKOYA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "grading", "allowed_models": ["claude-*"] }'

# Change it later, or send null to allow every model again:
curl -X PATCH https://wekoya-api.wekoya.tech/v1/keys/KEY_ID \
  -H "Authorization: Bearer $WEKOYA_API_KEY" -H "Content-Type: application/json" \
  -d '{ "allowed_models": ["claude-sonnet-5", "vendor:google"] }'

An exact id that is not in the catalogue is refused when you save it, because a typo would otherwise lock the key out of everything. Prefixes and makers are not checked, soclaude-* keeps working for a model launched next month.