Key Controls: Limits, IP & CORS — ML Junction docs

Every API key carries its own policy, editable from the key’s Controls tab. Spend caps are enforced per rolling window; when any window is exceeded the key is blocked until that window resets.

Above per-key limits, your account has a tier-based, account-wide ceiling on requests/min, tokens/min and concurrency that is shared across every key in the org - so adding more keys never raises your total throughput. A request must pass both the key limit and the account ceiling. Your tier rises automatically as cumulative purchased credits cross each threshold; the current tier, live usage, and the credit needed for the next tier are shown on the Billing page. A per-key limit set above the account ceiling is allowed but still capped at the ceiling. Hitting either limit returns a 429 with a rate_limit error.

Control · What it does
Account tier ceiling · Account-wide requests/min, tokens/min and concurrency shared across all keys; scales with purchased credits
Spend budgets · Cap USD per hour, day, week, month, or a custom window
Rate limits · Per-key requests/min, tokens/min, concurrency, and requests/min per client IP (capped by the account tier)
Model / provider / tier allowlists · Restrict a key to specific models, providers, or service tiers
IP allow / deny · Permit or block by IP or CIDR range
CORS · Per-key allowed origins, methods, headers, and credentials for browser apps
App attribution · Send an X-App header to tag and segment usage by your own application

Client IPs are resolved with a configured trusted-proxy hop count, so X-Forwarded-For values added before your Cloudflare/nginx edge cannot be spoofed. Every request records its IP, app id, service tier and user agent - visible in Activity and broken down in Usage analytics.

curl $BASE_URL/v1/responses -H "Authorization: Bearer $KEY" \
  -H "X-App: checkout-web" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-5.5","messages":[{"role":"user","content":"hi"}]}'

Canonical URL: https://mljunction.com/docs/key-controls