One key per person
Control time, budget and models
Issue every employee their own API key and scope it by expiry, budget and allowed models. Usage is metered by provider and model and converted into model fees, so your LLM budget is based on numbers, not guesses.
- Keys issued on hire, revoked on exit
- Time, budget and model quotas
- Tokens and fees by provider
- Cost estimates that suggest budgets
th-emp-7f3a••••••••c21eTime, budget and models, combined
Every employee key carries its own quota policy. Use each quota on its own or stack them; if any limit is hit, the request is blocked or downgraded according to the policy.
Time quotas
Control when a key works and for how long.
- Expiry: a fixed date, 30 / 90 days, 1 year, or for as long as the person is employed
- Allowed hours: for example weekdays 9:00–21:00 only, paused at night and on holidays
- Short-lived keys for probation, interns and contractors that switch off on their own
- Reminders to the employee and admin 7 days before expiry, with one-click renewal
Budget quotas
Control how much a key can use.
- Three meters: spend (CNY), tokens and requests, which can be combined
- Daily, weekly or monthly resets, with optional rollover of unused budget
- Threshold alerts to the employee and their manager at 80% and 90%
- Personal budgets are carved out of the team budget and never exceed it
Model quotas
Control which models a key can use, and how much of each.
- Model allowlist: open flagship, lightweight or local models by role
- Per-model limits, such as 50 flagship calls a day and unlimited local calls
- Calls to a model outside the allowlist are rerouted to an allowed equivalent or rejected
- Restrict sensitive roles to local models so data never leaves your network
Automate the key lifecycle, from hire to exit
Sync with LDAP, WeCom, DingTalk or Feishu so keys follow people. No more shared keys that nobody can trace when something goes wrong.
Set up a key for one employee
Pick an employee and a role template, then adjust expiry, budget and models. The key card and its quota policy update as you go.
th-emp-••••- Expiry
- —
- Allowed hours
- —
- Monthly budget
- —
- Flagship limit
- —
- On overage
- —
Demo only; nothing is submitted. Once deployed, push policies in bulk from the admin console or the OpenAPI.
Tokens and fees by provider and by employee
Every call records input and output tokens and converts them into model fees at each provider's rates (fees you pay the provider directly). Local models have no per-call fees, and cloud and local usage sit side by side in one table.
Tokens by provider this month
Sample organization · 200 employees · October 2026
| Provider | Input tokens | Output tokens | Fees | Share |
|---|
| Employee | Provider mix | Token | Fees | Budget used |
|---|
Sample data; fees use the sample prices in the cost estimator below.
Do the math before you roll out
TokenHub itself is a free download; this estimates the API fees you pay model providers. Enter headcount and usage, pick a model mix, and get a monthly cost and a suggested budget per person. You can edit every price.
| Model | Share % | Input ¥/1M | Output ¥/1M |
|---|---|---|---|
| Total share (normalized) | 100% | ||
Prices are samples in CNY per million tokens, for illustration only; check each provider's official pricing. Local models have no per-call fees, so they default to 0, but you can enter an internal rate (power plus hardware depreciation).
- Tokens / month
- —
- Per person / month
- —
- Suggested budget / person
- —
- Annual budget
- —
Suggested budget = monthly cost per person × 1.2 headroom, rounded up to ¥50.
What if everything ran on one model?
Monthly fees at your current usage
Running low shouldn't just mean "denied"
Pick an overage action that fits each role, so you control costs without stopping people mid-task.
Tiered alerts
Alerts at 80%, 90% and 100% go to the employee and their manager by in-app message, email, WeCom, DingTalk, Feishu or webhook.
Automatic fallback
Over budget, requests are rerouted to a cheaper cloud model or a local one. Nothing changes in the API, so most people never notice.
Top-up approvals
Employees request a temporary top-up, it takes effect once a manager approves, and it can plug into your existing approval flow with a full record.
Team pool
When a personal budget runs out, borrow from the team pool. The team stays within budget, and unused allowance doesn't go to waste.
Hundreds of keys, one table
Filter by department, template or status and act in bulk: CSV import, budget changes, renewals and revocations.
| Employee | Department / template | Key | Expires | Monthly budget | Allowed models | Status |
|---|---|---|---|---|---|---|
| WWang Lei | R&D · Engineering | th-emp-7f3a…c21e | 2026-12-31 | ¥186 / ¥300 | 4 | Active |
| CChen Jing | Customer Service · Support | th-emp-19bd…07aa | Ongoing | ¥45.2 / ¥50 | 2 | At 90% |
| LLin Xiao | Marketing · Content | th-emp-c4e1…5b30 | 2027-03-31 | ¥200 / ¥200 | 3 | On local fallback |
| ZZhao Yiming | R&D · Intern | th-emp-8a62…e9f4 | 2026-10-21 | ¥32.2 / ¥100 | 2 | Expires in 7 days |
| LLiu Yang | Product · Engineering | th-emp-2d07…a1c8 | 2026-12-31 | ¥145 / ¥300 | 4 | Active |
| ZZhou Min | Finance · Content | th-emp-5f90…3d12 | — | — | — | Revoked (left) |
Sample data
Quota templates
Preset expiry, budget and models for engineering, support, marketing, interns and more. New hires get the right template automatically.
Audit trail
Every call on every key records who made it, the model, tokens and fees, tied into the audit logs.
Reports and chargeback
Export monthly usage by person, department or provider for internal chargeback, and show it live on the Live Dashboard.
Employee quotas FAQ
How is an employee key different from a project key?
Project keys belong to applications and are used by backend services. Employee keys belong to a person, who uses them in IDE plugins, chat clients or scripts. Both go through the same gateway, metering and audit logs, and each gets its own budget.
Where do the estimator prices come from? Are they accurate?
The prices here are samples that show how the estimate works. Cloud models run on your own provider keys and you pay providers directly; TokenHub only meters and converts. Once deployed, admins maintain input and output prices per model (plus an optional internal rate for local models), and usage reports use that price table. Your provider's bill is the source of truth.
What happens when a budget runs out?
It depends on the overage action set for that employee: block the request and return quota_exceeded, fall back to a cheaper or local model, borrow from the team pool, or prompt the employee to request a top-up.
What happens to a key when someone changes roles or leaves?
With directory sync, a departing employee's key is revoked automatically. A transfer applies the new department's template to expiry, budget and models. Call history is kept for audits and cost tracking.
What if an employee key leaks?
An admin or the employee can revoke and reissue it in one click. Add an IP allowlist, allowed hours and a daily cap so that even a leaked key can't spend beyond its budget.
Can I allow local models only?
Yes. Limit the allowlist to local models and every request from that employee stays inside your network, which suits classified roles and data-sensitive teams.
Give every employee an AI key with guardrails
Free to download for personal and non-commercial use. For commercial deployments, contact us about a commercial license; we can also help design quota templates for your headcount and model mix.