Skip to main content
Model access controls which models an individual API key can call. It does not change your team’s enabled model range. Instead, it limits the models that a key can call within that range. Calls to models outside the key’s model access policy are rejected.
This capability covers models in the LLM product line. Standalone image and video multimodal capabilities are not currently included in model access configuration.
Examples:
  • Separate keys by purpose: let production keys call only stable models and experimental keys call only low-cost models.
  • Limit unexpected costs: if a key makes unexpected calls to high-cost models, restrict it to a smaller set of models.
  • Limit shared keys: for a key shared with a contractor or partner, allow only the agreed models.

​
Access modes

Each API key has one of two access modes: In both modes, the accessible models never exceed your team’s enabled model range and never include models that the platform has taken offline.
  • All enabled models: accessible models = team’s enabled models (including future ones) − excluded models.
  • Selected models only: accessible models = selected models (intersected with the team’s enabled models).

​
Configure model access

Only team admins can configure model access for an API key. Developers and Basic members see a read-only summary for keys they can access but cannot edit it. Billing members do not see model access.
1

Open Key Management

Go to Key Management and find the API key you want to configure.
2

Open model access settings

While creating or editing the key, open the Model Access section.
3

Choose an access mode

Select All enabled models or Selected models only:
  • For All enabled models, add any models you want to block under Excluded models.
  • For Selected models only, add at least one model under Accessible models.
4

Save

After you save, the new model access settings may take some time to take effect.
When creating or editing a key, you can reuse another key’s settings within the same team with Copy config and Paste config. After pasting, save the settings or adjust them first.

​
When a model is taken offline

A model being taken offline and an API key access restriction are different situations. Once a model is offline, no API key can call it. This is not a model access configuration problem with a particular key.
If the platform takes a model offline, it is removed from the set of available models:
  • Calls to that model immediately return a “model unavailable” response, even if the key previously had access to it.
  • If a key’s saved configuration still contains the offline model, the model remains visible but is greyed out. Remove it before saving; otherwise, the configuration cannot be saved.

​
When a call is rejected

An offline model returns a “model unavailable” response. This is not a key permission denial and does not return model_access_denied.
When an API key calls a model outside its model access policy, the call returns HTTP 403 with the error code model_access_denied. Contact your team admin to adjust the policy. See also Common Error Codes.
Last modified on September 1, 2026