> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cs2cap.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sub-Keys API: Create Child API Keys (Quant)

> Create and manage up to 25 child API keys under your Quant root key, each with optional per-key quota and rate limit overrides for access delegation.

The Sub-Keys API lets Quant accounts create up to 25 child API keys under a single active root key. Child keys inherit the Quant tier and can access all data endpoints, but they cannot create, update, revoke, or rotate keys. You can optionally apply per-child quota and RPM overrides to limit usage — overrides can only reduce limits below the parent tier ceiling, never increase them.

<Note>
  Sub-keys are available on Quant accounts only. All management routes require authentication with a session JWT or the root API key. Child keys cannot call management routes.
</Note>

## GET /account/sub-keys

Returns all active child keys with their current-month request counts.

**Tiers:** Quant

<CodeGroup>
  ```bash cURL theme={"theme":"github-dark-default"}
  curl -sS \
    -H "Authorization: Bearer $CS2C_API_KEY" \
    "https://api.cs2c.app/account/sub-keys?limit=10&offset=0"
  ```

  ```python Python theme={"theme":"github-dark-default"}
  import os

  import cs2cap

  configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

  with cs2cap.ApiClient(configuration) as client:
      api = cs2cap.AccountAPIKeysApi(client)
      response = api.list_sub_keys(
          limit=10,
          offset=0,
      )

  print(client.sanitize_for_serialization(response))
  ```

  ```typescript TypeScript theme={"theme":"github-dark-default"}
  import { Configuration, AccountAPIKeysApi } from "cs2cap";

  const accessToken = process.env.CS2C_API_KEY;

  if (!accessToken) {
    throw new Error("Set CS2C_API_KEY before running this example.");
  }

  const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
  const response = await api.listSubKeys({ limit: 10, offset: 0 });

  console.log(response);
  ```
</CodeGroup>

<ParamField query="limit" type="integer" default="25">
  Page size, clamped to 1–100.
</ParamField>

<ParamField query="offset" type="integer" default="0">
  Zero-based starting position.
</ParamField>

```json Response example theme={"theme":"github-dark-default"}
{
  "keys": [
    {
      "key": {
        "id": "cccccccc-cccc-cccc-cccc-cccccccccccc",
        "key_prefix": "sk_live_child",
        "name": "research-bot",
        "root_key_id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
        "is_root_key": false,
        "is_active": true,
        "created_at": "2026-03-02T12:00:00Z",
        "last_used_at": "2026-03-03T08:10:00Z",
        "expires_at": null,
        "quota_requests_per_month_override": 50000,
        "rate_requests_per_minute_override": 120,
        "effective_quota_requests_per_month": 50000,
        "effective_rate_requests_per_minute": 120
      },
      "requests_this_month": 812
    }
  ],
  "pagination": {
    "limit": 25,
    "offset": 0,
    "total": 1
  }
}
```

<ResponseField name="keys[].key" type="object">
  Key metadata object. Fields are identical to those returned by `GET /account/key`.
</ResponseField>

<ResponseField name="keys[].requests_this_month" type="integer">
  Number of requests made with this child key in the current calendar month.
</ResponseField>

<ResponseField name="pagination.total" type="integer">
  Total number of active child keys.
</ResponseField>

***

## POST /account/sub-keys

Creates a new child API key and returns the plaintext key value once.

**Tiers:** Quant

<CodeGroup>
  ```bash cURL theme={"theme":"github-dark-default"}
  curl -sS -X POST \
    -H "Authorization: Bearer $CS2C_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"name":"analytics-worker","quota_requests_per_month_override":100000}' \
    "https://api.cs2c.app/account/sub-keys"
  ```

  ```python Python theme={"theme":"github-dark-default"}
  import os

  import cs2cap

  configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

  with cs2cap.ApiClient(configuration) as client:
      api = cs2cap.AccountAPIKeysApi(client)
      response = api.create_sub_key(
          cs2cap.ChildAPIKeyCreateRequest(
              name="analytics-worker",
              quota_requests_per_month_override=100000,
          )
      )

  print(client.sanitize_for_serialization(response))
  ```

  ```typescript TypeScript theme={"theme":"github-dark-default"}
  import { Configuration, AccountAPIKeysApi } from "cs2cap";

  const accessToken = process.env.CS2C_API_KEY;

  if (!accessToken) {
    throw new Error("Set CS2C_API_KEY before running this example.");
  }

  const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
  const response = await api.createSubKey({
    childAPIKeyCreateRequest: {
      name: "analytics-worker",
      quotaRequestsPerMonthOverride: 100000,
    },
  });

  console.log(response);
  ```
</CodeGroup>

<ParamField body="name" type="string" required>
  Display name for the child key (e.g., `research-bot`).
</ParamField>

<ParamField body="quota_requests_per_month_override" type="integer">
  Optional monthly request cap for this child key. Must be less than or equal to the parent tier quota. Omit to inherit the parent tier ceiling with no additional child-specific cap.
</ParamField>

<ParamField body="rate_requests_per_minute_override" type="integer">
  Optional per-minute rate limit for this child key. Must be less than or equal to the parent tier RPM. Omit to inherit the parent ceiling.
</ParamField>

```json Request body theme={"theme":"github-dark-default"}
{
  "name": "research-bot",
  "quota_requests_per_month_override": 50000,
  "rate_requests_per_minute_override": 120
}
```

<Warning>
  The plaintext key is returned **once only** in the creation response. Copy and store it securely immediately. You cannot retrieve the plaintext value again after this response. Attempting to create more than 25 child keys returns `409`.
</Warning>

***

## GET /account/sub-keys/:id

Returns one active child key and its current-month request count.

**Tiers:** Quant

<CodeGroup>
  ```bash cURL theme={"theme":"github-dark-default"}
  curl -sS \
    -H "Authorization: Bearer $CS2C_API_KEY" \
    "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID"
  ```

  ```python Python theme={"theme":"github-dark-default"}
  import os

  import cs2cap

  configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

  key_id = "YOUR_CHILD_KEY_ID"

  with cs2cap.ApiClient(configuration) as client:
      api = cs2cap.AccountAPIKeysApi(client)
      response = api.get_sub_key(
          key_id
      )

  print(client.sanitize_for_serialization(response))
  ```

  ```typescript TypeScript theme={"theme":"github-dark-default"}
  import { Configuration, AccountAPIKeysApi } from "cs2cap";

  const accessToken = process.env.CS2C_API_KEY;

  if (!accessToken) {
    throw new Error("Set CS2C_API_KEY before running this example.");
  }

  const keyId = "YOUR_CHILD_KEY_ID";

  const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
  const response = await api.getSubKey({ keyId });

  console.log(response);
  ```
</CodeGroup>

<ParamField path="key_id" type="string" required>
  UUID of the child key to retrieve.
</ParamField>

***

## PATCH /account/sub-keys/:id

Updates a child key's name and optional quota or RPM overrides.

**Tiers:** Quant

<CodeGroup>
  ```bash cURL theme={"theme":"github-dark-default"}
  curl -sS -X PATCH \
    -H "Authorization: Bearer $CS2C_API_KEY" \
    -H "Content-Type: application/json" \
    -d '{"name":"analytics-worker-v2","quota_requests_per_month_override":200000}' \
    "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID"
  ```

  ```python Python theme={"theme":"github-dark-default"}
  import os

  import cs2cap

  configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

  key_id = "YOUR_CHILD_KEY_ID"

  with cs2cap.ApiClient(configuration) as client:
      api = cs2cap.AccountAPIKeysApi(client)
      response = api.update_sub_key(
          key_id,
          cs2cap.ChildAPIKeyUpdateRequest(
              name="analytics-worker-v2",
              rate_requests_per_minute_override=60,
          ),
      )

  print(client.sanitize_for_serialization(response))
  ```

  ```typescript TypeScript theme={"theme":"github-dark-default"}
  import { Configuration, AccountAPIKeysApi } from "cs2cap";

  const accessToken = process.env.CS2C_API_KEY;

  if (!accessToken) {
    throw new Error("Set CS2C_API_KEY before running this example.");
  }

  const keyId = "YOUR_CHILD_KEY_ID";

  const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
  const response = await api.updateSubKey({
    keyId,
    childAPIKeyUpdateRequest: {
      name: "analytics-worker-v2",
      rateRequestsPerMinuteOverride: 60,
    },
  });

  console.log(response);
  ```
</CodeGroup>

<ParamField path="key_id" type="string" required>
  UUID of the child key to update.
</ParamField>

<ParamField body="name" type="string">
  Updated display name.
</ParamField>

<ParamField body="quota_requests_per_month_override" type="integer | null">
  Updated monthly quota cap, or `null` to remove the child-specific cap and fall back to the parent tier ceiling.
</ParamField>

<ParamField body="rate_requests_per_minute_override" type="integer | null">
  Updated RPM limit, or `null` to remove the child-specific cap and fall back to the parent tier ceiling.
</ParamField>

```json Request body theme={"theme":"github-dark-default"}
{
  "name": "research-bot-v2",
  "quota_requests_per_month_override": 25000,
  "rate_requests_per_minute_override": 60
}
```

<Tip>
  Set an override field to `null` to remove that child-specific cap. The child key will then use the full parent tier ceiling for that limit.
</Tip>

***

## DELETE /account/sub-keys/:id

Revokes an active child key. The key immediately stops authenticating requests.

**Tiers:** Quant

<CodeGroup>
  ```bash cURL theme={"theme":"github-dark-default"}
  curl -sS -X DELETE \
    -H "Authorization: Bearer $CS2C_API_KEY" \
    "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID"
  ```

  ```python Python theme={"theme":"github-dark-default"}
  import os

  import cs2cap

  configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

  key_id = "YOUR_CHILD_KEY_ID"

  with cs2cap.ApiClient(configuration) as client:
      api = cs2cap.AccountAPIKeysApi(client)
      response = api.delete_sub_key(
          key_id
      )

  print(client.sanitize_for_serialization(response))
  ```

  ```typescript TypeScript theme={"theme":"github-dark-default"}
  import { Configuration, AccountAPIKeysApi } from "cs2cap";

  const accessToken = process.env.CS2C_API_KEY;

  if (!accessToken) {
    throw new Error("Set CS2C_API_KEY before running this example.");
  }

  const keyId = "YOUR_CHILD_KEY_ID";

  const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
  const response = await api.deleteSubKey({ keyId });

  console.log(response);
  ```
</CodeGroup>

<ParamField path="key_id" type="string" required>
  UUID of the child key to revoke.
</ParamField>

```json Response example theme={"theme":"github-dark-default"}
{
  "ok": true,
  "key_id": "cccccccc-cccc-cccc-cccc-cccccccccccc",
  "revoked_at": "2026-03-03T08:12:00+00:00"
}
```

<ResponseField name="ok" type="boolean">
  Always `true` on success.
</ResponseField>

<ResponseField name="key_id" type="string">
  UUID of the revoked key.
</ResponseField>

<ResponseField name="revoked_at" type="string">
  ISO 8601 timestamp when the key was revoked.
</ResponseField>

***

## POST /account/sub-keys/:id/reissue

Replaces an active child key and returns the new plaintext key once. The old child key is immediately revoked.

**Tiers:** Quant

<CodeGroup>
  ```bash cURL theme={"theme":"github-dark-default"}
  curl -sS -X POST \
    -H "Authorization: Bearer $CS2C_API_KEY" \
    "https://api.cs2c.app/account/sub-keys/YOUR_KEY_ID/reissue"
  ```

  ```python Python theme={"theme":"github-dark-default"}
  import os

  import cs2cap

  configuration = cs2cap.Configuration(access_token=os.environ["CS2C_API_KEY"])

  key_id = "YOUR_CHILD_KEY_ID"

  with cs2cap.ApiClient(configuration) as client:
      api = cs2cap.AccountAPIKeysApi(client)
      response = api.reissue_sub_key(
          key_id
      )

  print(client.sanitize_for_serialization(response))
  ```

  ```typescript TypeScript theme={"theme":"github-dark-default"}
  import { Configuration, AccountAPIKeysApi } from "cs2cap";

  const accessToken = process.env.CS2C_API_KEY;

  if (!accessToken) {
    throw new Error("Set CS2C_API_KEY before running this example.");
  }

  const keyId = "YOUR_CHILD_KEY_ID";

  const api = new AccountAPIKeysApi(new Configuration({ accessToken }));
  const response = await api.reissueSubKey({ keyId });

  console.log(response);
  ```
</CodeGroup>

<ParamField path="key_id" type="string" required>
  UUID of the child key to reissue.
</ParamField>

```json Response example theme={"theme":"github-dark-default"}
{
  "key": "sk_live_<xxxx>",
  "key_info": {
    "id": "dddddddd-dddd-dddd-dddd-dddddddddddd",
    "key_prefix": "sk_live_child",
    "name": "research-bot",
    "root_key_id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
    "is_root_key": false,
    "is_active": true,
    "created_at": "2026-03-03T08:15:00Z",
    "last_used_at": null,
    "expires_at": null,
    "quota_requests_per_month_override": 50000,
    "rate_requests_per_minute_override": 120,
    "effective_quota_requests_per_month": 50000,
    "effective_rate_requests_per_minute": 120
  },
  "message": "Store this key securely. It will not be shown again."
}
```

<ResponseField name="key" type="string">
  The new plaintext child key value. Shown only once.
</ResponseField>

<ResponseField name="key_info" type="object">
  Updated metadata for the reissued key. Overrides and name are preserved from the old key.
</ResponseField>

<Warning>
  The new plaintext key is returned **once only**. Copy and store it securely before closing the response.
</Warning>