How do I get an account?#
There is no public registration page. Sign in with your organization account through single sign-on — your first sign-in automatically provisions a personal workspace with you as its Owner. To join an existing organization, its Owner or an administrator sends you an invitation link. See Account and workspace and People and invitations.
What is a personal workspace?#
The private organization created at your first sign-in: a managed team, a managed project and a project wallet, with you as Owner. It has no People or Teams pages; workspace administrators can open Settings and Billing, and there is no assignment step — every published product is callable from the managed project. See Console overview.
How do I deliver an invitation?#
Copy the invitation link from the invite results or the invitation record and send it to the person through your own channel. See People and invitations.
Why was my call refused?#
Every refusal returns a JSON error with a code, enforced before any reservation, so
a refused call never charges. The common ones: 402 insufficient_budget (unfunded
wallet), 403 product_not_assigned (model not assigned to the key's project),
403 denied (no project consumption right), 401 invalid_api_key (bad or revoked
key). The full table with fixes is in Troubleshooting.
What does "Needs reissue" mean on my key?#
It marks a legacy key issued before keys became project-bound. It answers
403 key_unbound on every call, cannot be rotated and is never auto-repaired —
create a new project-bound key and revoke the old one. See
API keys.
What is the difference between Regenerate and Retry delivery?#
Regenerate asks for a fresh answer — a new call with its own reservation and charge. Retry delivery replays the same request under its idempotency key and does not charge again when the original answer can be replayed. See Playground.
Why is MCP off by default for my sandbox product?#
The MCP interface is an explicit opt-in on the sandbox record's Access section. Until you switch it on, the MCP URL refuses calls; the plain Invoke URL works regardless. Either way, only a key whose project owns the sandbox product can call it. See Sandbox products.
Why can't I see every wallet?#
Only the organization Owner sees every wallet; other administrators see only the wallets the server grants them, and the denied view says so. In a personal workspace you see your single managed wallet. See Wallets and audit.
How is charging calculated?#
Every admitted call reserves a conservative ceiling from the project wallet before dispatch, then settles the verified usage as the actual charge and releases the difference. While the outcome is unknown the reservation stays open — the call shows Holding budget — and is reconciled from verified provider evidence, never settled twice. See Usage and call records and Wallets and audit.
Where are my prompts and responses stored?#
Usage pages show model, parameters, tokens, latency and money figures without prompt or response text. Completed responses are retained privately for request replay, so absence from the usage page does not mean responses are never stored. Playground conversations are also saved in your browser. See Usage and call records.
Can I recover a lost API key secret?#
No — the secret is shown once at creation and only a hash is stored. The recovery path is Rotate key: it mints a replacement secret with the same scope and immediately revokes the old one. See API keys.
Why can't I leave my organization?#
Leave organization is disabled for Owners — ownership must be transferred first — and a personal workspace has no leave action at all. See Account and workspace.