Privacy and compliance · 2026-09-25
Building a team application without sharing the EVREN key
An EVREN API key is bound to the account of a person verified through e-Devlet. How to build an application that uses EVREN models without distributing that key inside a team, and which limits remain.
Short answer
On EVREN an API key belongs not to a project but to the account of a person verified through e-Devlet. Passing that key around a team means sharing that person's account. In LLMTR the key sits in one place, Settings; team members and applications work with their own LLMTR keys and never see the EVREN key.
We recommend using EVREN through LLMTR: you register your own EVREN key once in Settings, and the same code then reaches both EVREN models and the rest of the catalog. The key stays yours, and EVREN's own logging and retention policy still applies unchanged.
Who owns an EVREN key
Sign-in to EVREN goes through the e-Devlet gateway, and the API key is created on that personal account. Every request made with the key, and all quota and credit it consumes, accumulates on that account. If a use breaches the terms, that account is the one held to it.
For individual use the design is simple. For team and company use, the answer to "whose key is this" is always a person's name. LLMTR does not change that: whoever registered the key, EVREN usage made through LLMTR is charged to their EVREN account. What changes is that the text of the key does not circulate inside the team. EVREN offers the service free of charge until 1 November 2026; if a charge starts on EVREN's side after that date, it too goes to the EVREN account of whoever registered the key.
Where the key sits in LLMTR
The key is pasted once into the card for your own provider keys in Settings. It is stored encrypted and, once saved, is never shown again to anyone, including its owner; only the last four characters are visible. The authentication header of a request carries no EVREN key, only the LLMTR key.
The registered EVREN key is used only to send requests bound for EVREN rows; it is not sent to any other provider. It becomes unusable the moment it is removed, and EVREN rows then start returning 403 provider_credential_required.
What team members and applications receive
Instead of sharing the key, everyone who needs access gets their own LLMTR API key. One account can hold several API keys, and each can be revoked on its own. The table shows the roles and the key each one touches.
Labelling keys with the application and environment name makes it easy to tell in the usage log which request came from which application. On EVREN's side that split is not visible: every request goes out on the same EVREN key, so EVREN's quota and request records gather all of them on one account.
| Role | Key held | Cannot see |
|---|---|---|
| EVREN account owner | Registers the EVREN key in Settings and replaces it when needed | The full key text after saving |
| Developer | An LLMTR API key assigned to them | The EVREN key |
| Application server | That application's LLMTR key in an environment variable | The EVREN key |
| Browser or mobile app | No key; requests go through the server | Every key |
If a key leaks or its owner leaves
If an LLMTR key leaks, only that key is revoked; the EVREN key and other applications are unaffected. If the EVREN key itself leaks, the account owner signs in to EVREN with e-Devlet, revokes it, creates a new one and replaces the old one in LLMTR Settings. EVREN's /v1/quota endpoint can be used to check for unexpected consumption.
When the person who registered the key leaves the organisation, the EVREN account leaves with them, because the account belongs to the person. Another team member then registers their own EVREN key. Per-key spending limits do not cap EVREN usage: EVREN rows cost $0 on LLMTR, so these requests do not count as spending, and EVREN's own quota sets the limit.
On the code side
From the application's point of view, EVREN rows are no different from any other model. On the server, the application's own LLMTR key is read from an environment variable and an EVREN row is given as the model identifier. The EVREN key never appears in code, and no key is sent to a browser or mobile app.
Calling an EVREN row without the EVREN key in code
# Server side: no key ever reaches a browser or mobile app.
import os
from openai import OpenAI
# The environment holds only this application's LLMTR key.
# The EVREN key is not here; it is registered in LLMTR Settings.
client = OpenAI(
base_url=os.environ["LLMTR_BASE_URL"] + "/v1",
api_key=os.environ["LLMTR_API_KEY"],
)
def summarise(text: str) -> str:
res = client.chat.completions.create(
model="evren/gemma-4-31b",
messages=[{"role": "user", "content": f"Summarise briefly:\n{text}"}],
max_tokens=800,
)
return res.choices[0].message.contentFrequently asked questions
Should I use EVREN directly or through LLMTR?
We recommend using EVREN through LLMTR. Your requests still go to EVREN on your own EVREN key and LLMTR charges nothing for them; the difference is that the same code also reaches the other models in the catalog. EVREN's logging and retention policy is not affected by the choice.
Can I share my EVREN key with teammates?
The key is bound to your personal account, and every use made with it is charged to that account. Registering it once in LLMTR and giving teammates separate LLMTR API keys does the same job without circulating the key text.
Does the LLMTR spending limit cap EVREN usage?
No. EVREN rows cost $0 on LLMTR, so these requests do not count against a spending limit. Usage is capped by your EVREN account's own quota.
Can I call LLMTR directly from browser code?
Any key sent to a browser can be copied by anyone who opens the page. The LLMTR key stays on the server and the browser sends its requests to your own server; requests made with a revoked LLMTR key return 401.
What happens if the person who registered the key leaves?
The EVREN account belongs to that person and leaves with them. EVREN rows work again once another team member registers their own EVREN key in Settings.