Create an agent User API key and limit

Purpose

Create one User API key for an agent. Apply a limit to that exact key.

Prerequisites

You need access to create a Relay User API key. You need relay:limits:manage to create the policy.

A User API key belongs to one user. A user policy includes browser traffic and all keys owned by that user. An exact-key policy includes only the selected api_key_uuid.

Steps

1. Open Account → API Keys.
2. Create a Relay key.
3. Use a workload name, such as openclaw-production.
4. Keep the relay:request scope.
5. Copy the complete secret once.
6. Store the secret in the agent's secret manager.
7. Open Relay → Limits.
8. Open API Key Limits.
9. Add a policy.
10. Select the exact User API key.
11. Select all Relay traffic, one provider, or one incoming Model or Group key.
12. Select requests, tokens, or spend.
13. Select second, minute, hour, day, or month.
14. Enter the limit.
15. Enable and save the policy.

Example: set openclaw-production to 2,000 requests per day across all Relay traffic.

Expected result

Requests from the selected key consume the exact-key policy. The key owner's user policies and all broader policies also apply. The most restrictive applicable boundary wins.

Verification

Send a request with the new key. Confirm exact-key attribution in Relay → Logs. Confirm the policy state in Relay → Limits. Filter Relay → Usage by the key when organization visibility is available.

Recovery

If the policy does not apply, confirm that the request used the selected key and that Logs attributes it to the expected API-key ID. If you replace the key, recreate exact-key policies and use grants for the replacement UUID before you revoke the old key.

An exact-key denial does not place a shared Model or provider in cooldown. It does not block another key.

Next

Grant provider access.