Keys and spend

A key belongs to a workspace and spends that workspace's credits. Creating, editing or revoking one requires an admin or owner role, and keys are managed in Settings → API keys.

The key itself is shown once, at creation. Only a hash is stored, so a lost key can't be recovered — only revoked and replaced.

Render approval

Every key answers one question: what happens when the agent wants to render.

Confirm each render — the render tool returns a quote and starts nothing. Your agent has to approve that specific quote before anything spends. Approval is single-use and expires after ten minutes, and if the cost changes in between you get a fresh quote rather than a surprise.

Auto-approve — renders start immediately, up to the key's cap. Nothing stops to ask, so this is the setting to reach for once you trust a workflow, not before.

Either mode can be changed later on an existing key — you don't need to revoke and re-issue to move a key from confirming to automatic.

Spend cap

A cap is a credit ceiling over a rolling 24 hours. When a render would cross it, the render is refused and your agent is told how much has been spent. The API keys page shows each key's usage against its cap, so a cap is something you can watch rather than just set.

Caps sit on top of protections that already exist — your credit balance, the workspace's daily limit, and generation queue limits. A key can be more restrictive than those, never less.

Revoking

Revoke a key the moment it might have leaked. Revocation is immediate for new requests and takes effect everywhere within a minute.

Because a key acts as the person who created it, it also stops working if that person leaves the workspace — removing a teammate doesn't leave their credential spending behind them.

Good practice

• One key per thing that uses it. Shared keys can't be revoked without breaking everything at once, and usage tells you nothing.
• Start with confirmation, then relax it. It costs one extra call per render and tells you a lot about how your agent behaves.
• Cap even the keys you trust. A cap turns a bad afternoon into a small bill.
• Keep keys out of your repository. Pass ZETA_API_KEY from your environment rather than writing it into a config file you might commit.