For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Provider API keys
Verified : Code examples on this page have been automatically tested and verified.Provide and rotate the API keys that agentgateway uses to authenticate to your LLM providers.
Provider API keys authenticate agentgateway to LLM providers such as OpenAI or Anthropic. A leaked key lets attackers run requests at your expense.
Clients can authenticate with virtual keys. Agentgateway replaces each virtual key with the provider key before forwarding the request.
This guide covers inline keys, environment variables, files, and Kubernetes secrets or passthrough tokens. To replace an existing key, see Rotate a provider key.
Before you begin
Install theagentgateway binary.Configure your agentgateway proxy
You can set the provider API key in the UI or in your configuration file.
Start agentgateway with a configuration that has an
llmsection. You add the model and its API key in the UI.cat <<'EOF' > config.yaml # yaml-language-server: $schema=https://agentgateway.dev/schema/config llm: models: [] EOF agentgateway -f config.yamlOpen LLM > Models in the UI, such as http://localhost:15000/ui/llm/models, and click Add model.
From the Provider dropdown, select OpenAI.
Keep the default
openai/*in the Incoming model match field, and keep Strip openai/ for the Outgoing model.For the Provider API key, select one of the following options.
- API key: Enter the key itself, such as
sk-proj..... The UI writes the key inline in theparams.apiKeyfield. This option is the least secure. Only use this option for quick tests. - Env var: Enter the name of the environment variable, such as
OPENAI_API_KEY. The UI writesapiKey: $OPENAI_API_KEY. The variable must be set in the environment that agentgateway runs in, or the save fails. - File: Enter the path to a file that holds the key, such as
/etc/agentgateway/openai-key.txt. The UI writesapiKey: {file: <path>}. Agentgateway watches the file and reloads the configuration when the file changes, so a rotated key takes effect without a restart. This option differs from the File steps in the Config file tab, which useauth.key.value.fileand pick up a changed key on the next request. - Unset: Configure no provider credential.
- API key: Enter the key itself, such as
Click Save model.
Whether the UI can save depends on your storage mode. For more information, see Save changes from the UI.
Rotate a provider key
Rotate provider keys regularly, when your provider requires it, or after a suspected leak. Clients that use virtual keys need no configuration changes.
Create a new API key in the console of your LLM provider. Keep the old key active for now.
Replace the key on the gateway using the method that matches your configuration.
Option How to replace the key Restart needed File ( auth.key.value.fileorparams.apiKey: {file: <path>})Replace the file contents. With auth.key.value.file, agentgateway uses the new key for the next request. With aparams.apiKeyfile, agentgateway detects the change and reloads the configuration.No Inline Edit the key in the configuration file. Agentgateway reloads the file when it changes. No Environment variable Set the variable to the new key and restart agentgateway. Yes Send a request through agentgateway, and verify that it succeeds with the new key. If your gateway requires virtual keys, add an
Authorization: Bearer <virtual-key>header.curl -s http://localhost:4000/v1/chat/completions \ -H "Content-Type: application/json" \ -d '{"model": "openai/gpt-4o-mini", "messages": [{"role": "user", "content": "Hello!"}]}' | jq .Example output:
{ "choices": [{ "message": { "role": "assistant", "content": "Hello! How can I help you today?" } }] }Revoke the old key in the console of your LLM provider.
