Enterprise Quickstart

OpenDunes is designed for teams that need multiple isolated API keys, spend controls, and a compliance posture that satisfies Algerian data-protection law (Law 18-07). This page walks through the full setup from first deposit to production-ready keys.

Account setup#

1. Create an organization account at opendunes.com.
2. Deposit DA via SATIM (CIB or Edahabia) from Dashboard → Billing. DA is the only billing currency — every invoice and balance is in dinars.
3. Verify your email. Your default API key is created automatically and visible in Dashboard → Keys.

Create team keys#

Isolate workloads by creating one key per service, environment, or team member. That way a compromised key can be rotated without disrupting everything else.

Each key:

• Looks like sk- followed by a hex string. It's shown only once — copy it before closing the dialog.
• Has its own usage counters, optional rate limit, and model allow-list.
• Can be revoked without touching other keys.

Create keys from Dashboard → Keys, or provision them programmatically with the Management API. Management calls use a separate mk-… management key — created in Dashboard → Settings → Management Keys — never a regular sk- key:

curl https://opendunes.com/api/v1/management/keys \
  -H "Authorization: Bearer $OPENDUNES_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "production-backend"}'

A 201 response returns the key record plus raw_key — the sk-… value is shown once, so store it immediately:

{
  "api_key": { "id": "…", "name": "production-backend" },
  "raw_key": "sk-0a1b2c3d..."
}

List existing keys with GET /v1/management/keys (returns {"data": [...]}) and revoke one with DELETE /v1/management/keys/{id}. There is no update operation — to rotate a key, create the replacement, move traffic over, then delete the old one. Rate limits and model allow-lists are set per key from Dashboard → Keys.

Set per-key limits#

Limits prevent any single key from monopolizing the shared balance. When a key exceeds its rate limit, requests return 429 rate_limit_exceeded — other keys keep working. Spend itself is drawn from the shared account balance: when the balance runs out, requests return 402 insufficient_credits.

You can update a key's rate limit and model allow-list at any time from Dashboard → Keys via Edit Limits.

Monitor usage and analytics#

Every request is logged with model, token counts, DA cost, and a UUID-v7 trace ID (X-Request-Id response header). View the breakdown by key, model, and time range in Dashboard → Analytics.

Programmatic access is live: GET /v1/activity returns daily usage rollups and GET /v1/credits returns your balance — both authenticated with your regular Bearer sk- key. The X-Balance-Available header on every response also gives you real-time balance visibility in micro-DA:

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://opendunes.com/api/v1",
    api_key=os.environ["OPENDUNES_API_KEY"],
)

resp = client.chat.completions.create(
    model="openai/gpt-5.4",
    messages=[{"role": "user", "content": "Summarize the latest quarter."}],
)

# Read remaining balance from the raw HTTP response
# (OpenAI SDK exposes this via resp._response.headers on most versions)
print(resp.choices[0].message.content)

Law 18-07 compliance#

Algeria's Law 18-07 on personal data protection applies to any system that processes user PII. OpenDunes addresses this at the infrastructure level so you don't have to build your own redaction pipeline.

What OpenDunes does for you:

• PII redaction — prompt and response content is scanned before storage; detected PII (names, phone numbers, national IDs, email addresses) is replaced with type tokens (e.g. [NAME]) in logs.
• Data residency — request logs are stored on infrastructure physically located in Algeria.
• Audit trail — every request carries a UUID-v7 trace ID, logged with timestamp, model, and key identifier (never the key itself). Audit exports are available on request.
• Append-only ledger — all billing movements are double-entry and immutable. No record is deleted or modified after creation.

Note. Your application is still responsible for what you send in messages. Do not send raw user-submitted PII (e.g., full national ID scans, medical records) in prompt text unless your use case specifically requires it and you have documented consent under Law 18-07.

Rate limits#

The default is 60 requests/minute per key. Enterprise accounts can request higher limits by contacting support. When a key is rate-limited, the response is:

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Retry after 12 seconds.",
  "retry_after": 12
}

Honor the Retry-After header (also X-RateLimit-Reset) and implement exponential backoff for production systems.

Recommended team key structure#

Rotate keys on a schedule (quarterly is a common baseline) and immediately on any suspected leak.

Next steps#

• API Keys reference — full key lifecycle documentation.
• Rate Limits — limits, headers, and retry strategy.
• Models — browse the full catalog with DA pricing.
• Build a Chat App — end-to-end chat example.