Skip to main content
Model access controls which models an individual API key can call. It does not change your team’s enabled model range — it only narrows, within that range, the set of models a given key is allowed to call. Calls to models outside a key’s access range are rejected.
This capability covers models in the LLM product line. Standalone image and video multimodal capabilities are not part of model access configuration for now.
Common use cases:
  • Isolate keys by purpose: let production keys reach only stable models, and let experimental keys reach only low-cost models.
  • Contain risk quickly: when a key triggers unexpected high-cost model calls, restrict it to a few safe models.
  • External collaboration: for keys shared with contractors or partners, expose only the agreed models.

​
Access modes

Each API key has one of two access modes: In both modes, the accessible models never exceed your team’s enabled model range and never include models that have been taken offline.
  • All enabled models: accessible models = team’s enabled models (including future ones) − excluded models.
  • Selected models only: accessible models = selected models (intersected with the team’s enabled models).

​
Configure model access

Only team admins can configure model access for an API key. Developer and Basic members see a read-only summary for keys they can access but cannot edit it; Billing members do not see model access at all.
1

Open Key Management

Go to Key Management and find the API key you want to configure.
2

Open model access settings

While creating or editing the key, open the Model Access section.
3

Choose an access mode

Select All enabled models or Selected models only:
  • For All enabled models, add any models you want to block under Excluded models.
  • For Selected models only, add at least one model under Accessible models.
4

Save

After you save, the new model access settings may take some time to take effect.
When creating a new key or editing an existing one, you can reuse another key’s settings within the same team with Copy config and Paste config. After pasting, you can save directly or adjust first.

​
When a model is taken offline

If a model is taken offline by the platform, it leaves the set of available models:
  • All calls to that model immediately return a “model unavailable” response.
  • If a key’s saved configuration still contains the offline model, it stays visible but greyed out. You must remove it before saving — otherwise the configuration cannot be saved.

​
When a call is rejected

When an API key calls a model outside its access range, the call returns HTTP 403 with the error code model_access_denied, indicating that the key cannot access that model. Contact your team admin to adjust the key’s model access. To manage a key’s model access programmatically, see Get API Key Model Access Policy.
Last modified on July 22, 2026