One endpoint,
every model.
Tare is an OpenAI-compatible gateway in front of every model you use — ours and the ones you bring yourself. One base URL, one key, and every token accounted for.
API keys
Authorization: Bearer ak-… on every request.
Keys as the unit of governance
There is deliberately no department-and-project layer above keys: a modelled org chart stops matching reality at the first reorg, and a wrong one is harder to work with than none.
The cost of that choice is that a statement line reading ak-3f2a — $4,200 maps to nobody, so
give every key a purpose when you create it — for example Support bot (production).
Key attributes
| Identity | Usage, spend and statements are all attributed to it |
| A credit limit | Optional. A runaway job stops at the limit instead of at your balance |
| A router binding | Optional. Binds a key to a specific set of routes; see Routing |
| An IP allowlist | Optional. Calls from anywhere else are refused; see below |
Restricting a key to certain IP addresses
Console → API Keys → edit a key → Only allow this key from certain IP addresses. One address or CIDR block per line, IPv4 and IPv6 both accepted.
A call from anywhere else gets 403 with metadata.refusal_reason = source_ip_not_allowed. The
key itself keeps working — this is a fence, not a revocation, so a stolen key is worth much less
without also being on your network.
[!WARNING] Allowlist the address your server goes out through, not its LAN address and not the machine you have the console open on. The console shows "we see this browser as X" as a reference — on most setups that is a different address from your server's.
Three things that surprise people, all of them deliberate:
- IPv4 and IPv6 do not cover for each other.
203.0.113.7does not match a call that went out over IPv6. If either is possible, list both — silently letting the other family through would mean the restriction stopped applying without anyone noticing. - Turning the switch off is not the same as clearing the list. The list is kept, so a temporary exception does not cost you the list.
- The switch on with an empty list refuses everything, it does not allow everything. The console will not let you save that combination, and the server treats it as "deny" if it ever occurs.
If a call is refused, the message says which address we saw and which header it came from — that sentence is usually the whole investigation. Most surprises are one of: a LAN address was entered, the server egresses over IPv6, or there is one more NAT/proxy hop than expected.
Rotation
Create the new key, deploy it, then disable the old one. Disabling is immediate and reversible; usage already recorded against the old key stays there, so the month's statement shows both — which is exactly what proves the cutover was complete.
[!WARNING] The full key is shown once, at creation; only a hash is stored. A lost key cannot be recovered by anyone, Tare included — create a new one.