A key that stops

You connect the provider accounts you already pay. Till stores those credentials encrypted and does not return them after save. The workload gets a Till key. Leaking that key does not reveal the upstream credential.

Every Till key requires an activation ceiling: how many upstream attempts it may make. You can also cap tokens, cap estimated spend, set an expiry, and limit source IPs. When one of those is hit, that key stops.

If the key leaks or the job goes wrong, revoke that key. The provider connections behind it stay in place. The Till key is still a bearer secret until it stops or you revoke it.

A positive activation count. Till counts each attempt it dispatches upstream, including a failed provider or transport response. A request Till rejects locally is refunded. This is a lifetime operation limit for that key. It is not a per-minute rate limit.

A positive token cap, or none. A generation request that uses a token or spend limit also needs an explicit output cap, so Till can reserve capacity before it sends the call.

A positive cap in cents, or none. Till enforces it only when it has a price for the model. It reserves a conservative amount, then settles to reported usage. The provider still bills your provider account. This estimate is not the provider invoice, and it does not replace provider billing alerts.

A future time. After it, the key is expired and stops accepting requests. Leave it unset and the key does not expire on its own.

IP addresses or CIDR ranges. Requests from other addresses are rejected. The key itself can still be used from an address you allowed. This is available on every plan, not a paid add-on.

You can revoke a key immediately. Revoked stays revoked. Raising a limit or clearing an expiry can bring an exhausted or expired key back; it does not bring a revoked key back.

Add the provider accounts once. Automatic keys route among the connections on the account, including ones you add later. The workload never receives those credentials.

Set the required activation ceiling. Add a token budget, an estimated-spend cap, an expiry, or an IP allowlist when the job needs a tighter bound.

The agent, contractor, or demo sends requests with the Till key. Till checks the key, then forwards the call to a configured provider.

It stops when the activation, token, or estimated-spend limit is reached, or when it expires. You can also revoke it. The provider connections stay where they are.