How it works

• Keys are fetched from DB at call time (30 s cache) — no container restart needed.
• Routing (ADR-0116): bind a key to a service (Shared = any service). The Default key is the funded fallback a service uses when it has no bound key. Order: bound-to-service → default → shared; on a 402 it spills to the next.
• On HTTP 402 (credit quota exceeded), the key is auto-deprecated and the next active key is tried within the same request.
• Restore a deprecated key after topping up its credit balance with the Restore button.
• If the pool is empty, the engine falls back to its configured OCR-A environment key.