# API key groups, permissions and limits

## Organize keys by purpose
Use separate keys for different tools and name them clearly. Keys belong to an account, but that does not imply identical model permissions.

## Check model permissions
Confirm which key your client uses, then inspect its group in [API key management](https://aoxtoken.com/keys). Check both the model list and an actual request; a successful list request does not prove generation access.

## Limits and validity
Account allowance, key-specific limits and key status are separate checks. Preserve the actual error code and message instead of inferring the cause solely from the HTTP status.

## Replace or revoke
Confirm what a key is used for before changing it. Revoke a leaked key, create a replacement and update the client. Verify that the new key works and the old key no longer does.

Tests across groups, quotas and revocation remain incomplete. Fields and limits depend on the actual service version.