Provider keys
Provider credentials live server-side and rotate at runtime, without a redeploy.
Set provider API keys on the Providers page (or GET / PUT /admin/provider-keys) rather
than the ANYRAY_PROVIDER_KEY_* env vars; the runtime path wins, and keys stay
server-side. Without any key, BYO clients
must send both the provider credential and their Anyray client key.
Named provider keys
A provider can hold several named keys; one is the default and serves every request that
doesn't pin an id. Add them on the Providers page ("Add key": a lowercase id such as team-ml,
an optional label, and the credential; available on every provider, including one with no
credential yet, where the first named key becomes the default), or via PUT /admin/provider-keys:
| Patch | Effect |
|---|---|
{ "keys": { "<id>": <credential> } } | Adds or replaces that named key. |
"" or null under an id | Removes that key. |
"defaultKeyId": "<id>" | Which key serves unpinned requests. |
| A bare credential for the provider | Still replaces the default key, exactly as the single key did before. |
"" for the provider | Removes all of its keys. |
Named keys are pinned from routing configs with provider_key_id
(Routing); each spend row records which
key served it (providerKeyId, the content-free id only). On the Routing page every target
and lane carries a Key column: a picker once the provider holds two or more keys, otherwise
default key.