Per-Key Harness Management

Router9 treats each API key as one harness identity. Because every request is classified by harness and grouped into tasks, each key gets its own profile, budget, and controls — so you can understand, contain, and secure each tool independently. Manage everything from the Keys page and each key's profile.

Harness Profile

Open a harness from the Harnesses page to see its profile over time:

• Usage trend — daily request activity as a heatmap
• Tasks — agentic runs grouped by task, with average steps and tokens per task
• Cache-hit rate — how much of the key's input was served from the prompt cache (higher is cheaper)
• Observed harnesses — which tools the key's traffic classifies as

A single dominant harness is the healthy signal for a key bound to one tool. The By Harness tab on the Usage page breaks your whole plan's usage down the same way. The harness's tool type (and icon) is auto-detected from this dominant classification.

Rotating a Harness Key

Each harness owns one API key. Refresh key (on the harness page) regenerates the secret in place: the new key is shown once, the old key stops working immediately, and the harness keeps its name, type, budget, policies, and full history. Rotate whenever a key may have leaked — especially after a drift alert.

Key Budgets

Available on Pro and Max plans.

Give a key a monthly budget in credits to contain a single harness's spend:

• Soft alert — you get an email when the key crosses its alert threshold (80% by default). Requests keep flowing.
• Hard limit — turn this on to reject the key's requests with 429 once the budget is exhausted. Requests carry X-Key-Budget-Limit, X-Key-Budget-Used, and X-Key-Budget-Remaining headers so your harness can react.

Budgets reset at the start of each calendar month and are counted in addition to your plan's shared credit allowance — never a replacement for it.

Identity Binding & Drift Detection

Available on Pro and Max plans.

Bind a key to the harness you expect to use it (for example claude-code). When a harness's traffic strongly matches one tool type, Router9 suggests the binding on its profile — one click to enable protection. If the key's traffic later classifies as a different harness, Router9 flags the key and emails you — a strong signal that the key may have leaked or been shared.

Drift detection is alert-only: it never blocks traffic. When drift is detected, a banner appears on the key's profile with the last-seen time. If you didn't switch tools, rotate the key.

Key Policies

Available on Pro and Max plans.

Tighten what a key can do:

• Model allowlist — restrict a key to specific model slugs (e.g. a CI key limited to cheaper models). Requests for other models get 403.
• Rate limit — cap a key at N requests per minute, independent of your plan-wide limits.

Reports & Hygiene

• Weekly report — your weekly usage email includes a per-key breakdown (requests and credits per key, labeled by harness).
• Idle-key reminders — keys unused for 30+ days earn a rotation reminder.
• Health alerts — a key with a sustained high error rate triggers an alert so you can catch a misconfigured harness or upstream outage early.
• Cost showback — export a key's usage as CSV (with harness and credits columns) for internal chargeback.

Alerts respect your notification preferences and are debounced so a looping agent never floods your inbox.