Everything you need to know about scoped API keys, security, pricing, and integrating Till with your AI agents.
Getting Started
Till is an API key proxy that creates scoped, disposable API keys for AI agents. Instead of giving agents your real API keys from OpenAI, Anthropic, or other providers, you create Till scoped keys with hard limits on activations, tokens, or spend. When any limit is reached, the key stops working automatically.
Till supports 12 AI providers: OpenAI, Anthropic, Google (Gemini), OpenRouter, Mistral, Groq, Together AI, Fireworks, Perplexity, DeepSeek, xAI, and Cohere. All providers use the same scoped key interface with consistent limit enforcement.
Use it exactly like a normal API key, but point your requests to Till's proxy endpoint. For example, instead of api.openai.com, use api.till.ac/proxy/openai. The scoped key goes in the Authorization header as usual. Till handles the rest.
Limits & Controls
You can set three types of limits:
1. Activation limits - Cap the number of API calls (50 means exactly 50 requests) 2. Token limits - Cap total input + output tokens across all calls 3. Dollar limits - Set a hard spend budget with built-in pricing for 80+ models
Whichever limit hits first disables the key.
The key is automatically disabled and returns an error to the caller. The agent receives a clear error message indicating the limit was reached. Your real upstream key was never exposed, and you won't receive surprise bills.
Yes. You can revoke any scoped key at any time through the dashboard or API. Once revoked, the key immediately stops working even if it hasn't reached its limits.
Security
Till uses a zero-knowledge architecture. Your upstream API keys are AES-256-GCM encrypted and embedded directly in the scoped token - they're never stored in Till's database. The database only contains hashed lookup keys and usage counters. If Till were breached, attackers would find zero usable API keys.
Traditional vaults store keys centrally - a breach exposes everything. Till embeds encrypted keys in tokens and enforces limits at the proxy layer. No central key storage means no central point of compromise.
If you lose a scoped token, there's no way to recover the upstream key from it - Till never stored it. This is by design for security. You can revoke the lost token and create a new one using your upstream key.
Yes. Till fully supports streaming responses from all providers. Usage tracking works with streaming when the provider includes usage data in the stream (OpenAI does this with stream_options).
Till's core proxy is available for self-hosting. The hosted service at till.ac provides additional features like the dashboard, billing, and managed infrastructure.
Ready to secure your AI agents?
Create your first scoped key in under a minute. Free tier includes 3 keys and 1,000 activations.