Quickstart

Guardrails

Guardrails limit where an API key can be used, which tiers and auto-routing candidates it can access, and how much it can spend.

ScenarioRecommendation
Local developmentSeparate key, small budget, start with auto
Development backendIP allowlist, explicit tier, budget limit
Coding agent / IDEDedicated key, small daily or weekly budget
High-risk agentKey budget plus app-side stop conditions
Stable development workflowfixed tier and key budget

Available Limits

LimitUse
IP allowlist / blocklistRestrict request source
allowed tiersRestrict economy / standard / premium
model blacklistExclude models from automatic routing
daily / weekly budgetLimit period spend
routing strategyControl auto-routing preference

Rejected Requests

ErrorCommon cause
403 invalid_api_keyKey is invalid, revoked, expired, or not active
403 policy_rejectedIP, tier, blacklist, or blocked policy failed
402 insufficient_quotaWallet balance, budget, or pre-freeze failed

Change Policy

Use a new key to replace the old key:

  1. Create a new key with the new policy.
  2. Send a test request with X-Request-ID.
  3. Confirm logs and usage in JoyToken Console.
  4. Switch environment variables.
  5. Revoke the old key after observation.