Skip to navigation
Management APICredentials

Create Credential

Add your own API key for a vendor (BYOK). The gateway calls the vendor with it as your organization’s key usage settings decide. An organization has one credential per vendor, so a second one is a 409. The key isn’t tested on save: send a request to a model on that vendor to check it. Needs a Pro or Enterprise plan.

Authentication

AuthorizationBearer

A management key (mgmt_...), sent as Authorization: Bearer <key>. Reading /v1/routing-policies also accepts the organization’s gateway API keys; writing there needs a management key.

Request

This endpoint expects an object.
vendorstringRequired<=100 characters

The vendor’s slug, like openai. Can’t change after creation: delete the credential and create a new one to switch vendors. An organization has at most one credential per vendor.

api_basestring or nullOptional
A custom base URL for the vendor's API, such as your own proxy.
api_keystring or nullOptionalformat: "password">=1 character

The vendor API key. Required except for vertexai (uses config.service_account_json) and bedrock (can use AWS keys or a role in config instead). Never returned.

configobject or nullOptional

Vendor-specific settings, such as the Bedrock region or the Vertex AI project.

fallback_to_managedbooleanOptionalDefaults to true

When a request with this key fails, retry it once on Merge-managed access for the same vendor, if the organization has it.

namestring or nullOptional<=255 characters
A name for the credential, shown in the dashboard.

Response

The created credential
api_basestring or null
A custom base URL for the vendor's API, such as your own proxy.
configobject

The non-secret vendor settings. Settings that aren’t set are null.

created_atdatetime or nullRead-only
When the credential was created.
credential_hintstring or nullRead-only

The last 4 characters of the stored API key, like a1b2, to tell keys apart. null when the credential has no API key, or the key is under 12 characters (4 would give away too much of it).

fallback_to_managedboolean

When a request with this key fails, retry it once on Merge-managed access for the same vendor, if the organization has it.

idstringRead-onlyformat: "uuid"
The credential's id.
namestring or null
A name for the credential, shown in the dashboard.
updated_atdatetime or nullRead-only
When the credential last changed.
vendorstring

The vendor’s slug, like openai. Can’t change after creation: delete the credential and create a new one to switch vendors. An organization has at most one credential per vendor.

Errors

400
Bad Request Error
401
Unauthorized Error
403
Forbidden Error
409
Conflict Error
422
Unprocessable Entity Error
503
Service Unavailable Error