Skip to main content
Management tokens let you automate account tasks without sharing your inference API key. Choose Usage only for a quota widget or monitoring script: that token cannot run models, spend your balance, or create API keys.

​
Create a token

  1. Open Settings → Security → Management API tokens.
  2. Select New token, enter a name, and choose Usage only — view subscription quotas.
  3. Choose an expiration and copy the secret when it is shown. It is shown only once.
Registration is optional: anonymous browser sessions can create, list, and revoke management tokens too. Tokens belong to the session that creates them. Save your sign-in key before clearing browser data so you can restore access and revoke tokens later. A management token cannot restore your browser session. Tokens expire after 90 days by default (365 days maximum). You can revoke them in Settings. Store the token as a secret: anyone who has it can read the data its scopes allow. Send it in an authorization header, not a URL.

​
Read subscription usage

Example response (limits are illustrative; use the returned values):
  • active and state describe subscription status. Active status alone does not mean quota remains.
  • dailyInputTokens and weeklyInputTokens count input tokens, not requests or dollars. dailyImages counts images.
  • Each quota includes used, remaining, percentUsed (a fraction; multiply by 100 for display), and resetAt (UNIX epoch milliseconds). percentUsed can exceed 1.
  • A null quota/limit means that window is not configured or applicable. If a lookup is unavailable, the quota’s counters are null and degraded: true; display unknown, not zero usage or a full allowance.
  • period.currentPeriodEnd is an ISO timestamp or null. Use the returned reset times instead of hardcoding billing or quota windows.
  • Token-based trials also return usageUnits: "tokens", tokenLimits.total, and a tokens quota object.
The endpoint reads the token owner’s personal subscription. It accepts no account selector or force-refresh parameter. It returns no API-key secrets, Stripe identifiers, cancellation metadata, cash balance, or query history. Normal status refresh and quota reconciliation may run during a read. For inference-key-specific billing advice, use the existing Subscription Usage endpoint with an inference API key. Management tokens cannot authenticate inference endpoints.

​
Verify a Usage only token

After creating a token with only usage:read, check that it can read quotas:
Expect 200 with the usage fields described above. An inactive subscription can still return a successful response; check active, state, and the quota fields instead of assuming that HTTP success means included usage is available. Then check its permission boundary with a read-only API-key list request:
A token with only usage:read must return 403 with insufficient_scope here. If it returns 200, the token has API-key read or write permissions too; create a token with only Usage only access for your monitoring tool. Missing, invalid, expired, or revoked management tokens return 401 with invalid_management_token. To check revocation, revoke a disposable test token in Settings and repeat the usage request; it should return 401. Keep the token out of screenshots and logs.

​
Permissions

API-key scopes do not include usage:read. Existing tokens do not gain new permissions. Create a new token when you need a different scope. For monitoring, select only usage:read: a token with api_keys:write can create keys that spend money.

​
API-key management

Base URL: https://nano-gpt.com/api/management/v1. Authenticate with Authorization: Bearer sk-nano-mgmt-.... Creating an inference key requires an Idempotency-Key header. The new key secret is returned only on creation and an exact idempotent replay. List, read, and update responses do not return it. See the Management OpenAPI contract for request and response schemas. Ordinary inference API keys cannot call the Management API.

​
Errors

  • 401: missing, invalid, expired, or revoked management token.
  • 403 with insufficient_scope: create a token with the required scope.
  • 429: rate limited; respect Retry-After.
  • 503: temporarily unavailable; retry with backoff and respect Retry-After when present.
Responses are private and uncached. Retain X-Request-Id for troubleshooting; never log the authorization header.