API Keys

The API Keys module centralizes the credentials that AI Gateway uses to authenticate with LLM provider APIs (OpenAI, Gemini, Anthropic, Azure OpenAI, Azure AI Foundry, Bedrock, Vertex AI, and Custom). Each API Key is linked to a single provider and later referenced by LLM Providers.

NOTE

Register API Keys before configuring LLM Providers. Each provider configuration requires an existing key.

Quick links

Learn how to:

• Filter and list API Keys
• Create an API Key
• View an API Key
• Edit an API Key
• Delete an API Key
• Review the Audit Log record
• Review the form fields
• Review permissions

Listing

The API Keys page lists all registered credentials with pagination. You can filter by:

• Provider (optional): LLM provider the key belongs to. Available values are All Providers (no filter), OpenAI, Gemini, Anthropic, Azure OpenAI, Azure AI Foundry, Bedrock, Vertex AI, and Custom.

Use Search to apply the filter and Clear to reset it.

Columns shown in the table:

• Provider: provider associated with the key.
• Description: description registered to identify the key.
• Created At: creation date and time in your time zone.
• Actions: View and Delete icons for each row, each one shown according to the user's permission — see Permissions. The whole column disappears when neither icon is available.

Create API Key

View API Key

In the Actions column of the row you want, click the View icon. This opens the read-only Overview screen, on the General Info tab. The API Key configuration block holds the following fields:

• Provider
• Description
• Created At

No field is editable on this screen, and the API Key value does not appear on it: reading a credential does not return the key, so there is no masked value to display. An empty Description shows —.

Edit API Key

Editing lives inside the details screen. Open the credential through the View icon (see View API Key) and, on the Overview screen, click the Edit button next to the API Key configuration title. The Update API Key form appears without the previously registered API Key value. The Provider field is immutable after registration. To change the provider, delete the current key and create a new one.

In the edit form you can:

• Update only the description: change the Description and leave the API Key field blank (it displays the text Leave blank to keep the current key). The registered key is preserved.
• Replace the key: enter the new value in API Key. Use the eye icon next to the field to check what you typed before saving.

Click Save to confirm.

Delete API Key

In the Actions column of the row you want, click the Delete icon. Confirm the operation in the "Are you sure you want to delete this API key?" dialog.

IMPORTANT

Deletion is permanent and cannot be undone. If an LLM Provider references the key, routes that depend on that provider start failing. Update or remove dependent configurations before deleting the key.

Audit Log record

Creating, editing, or deleting an API Key generates a queryable record in the Access Control Audit Log, with the date, the author, the outcome of the operation, and the object's content. Querying, listing, or opening the detail of an API Key doesn't generate a record — only write operations are audited.

A request refused right at the entry point — for example, due to invalid data — generates no record at all. From the moment the operation is processed, both success and failure generate a record, and the failure record carries the reason and the configuration that was attempted, including when the failure happens because the object doesn't exist. On a deletion, when the object's content can't be read before removal, the record carries only the API Key identifier.

The record never exposes the API Key value — not in the success content, and not in the reason or attempted configuration of a failure.

Querying the Audit Log uses the Audit List (access-control.audits.list) and Audit View (access-control.audits.view) permissions, which already govern that screen.

Form fields

The table below covers all fields in the creation and edit forms.

TIP

The gateway treats the key as sensitive information. No screen displays the key in plain text after registration. Use the Description to identify each credential in the listing.

Permissions

Access to each action in the API Keys journey depends on its own permission. Without the corresponding permission, the screen element does not appear — the interface never shows an unavailable action as disabled.

Permissions are granted in Access Control, on the Roles screen, under the AI Gateway product. The table below lists each one exactly as Access Control displays it.

A control without its permission is not rendered; an API Key reached directly by URL without its permission lands on the AI Gateway's own access denied screen, not on Access Control's.

EDITING REQUIRES VIEWING

The Edit button only exists inside the credential's Overview screen. Because of that, a user holding Create and Update API Keys but not View API Key has no path to edit an already registered credential. This is expected platform behavior, not a bug.