Provider keys
Provider credentials live server-side and rotate at runtime, without a redeploy.
Set keys on the Providers page or with GET / PUT /admin/provider-keys. This runtime path
wins over the ANYRAY_PROVIDER_KEY_* env vars, and keys stay
server-side. With no key set, BYO clients must
send both the provider credential and their Anyray client key.
Named provider keys
A provider can hold several named keys. The default key serves every request that doesn't pin
an id. On the Providers page, Add key takes a lowercase id (such as team-ml), an optional
label, and the credential. On a provider with no credential yet, the first named key becomes the
default.
PUT /admin/provider-keys patches:
| Patch | Effect |
|---|---|
{ "keys": { "<id>": <credential> } } | Adds or replaces that named key. |
"" or null under an id | Removes that key. |
"defaultKeyId": "<id>" | Which key serves unpinned requests. |
| A bare credential for the provider | Replaces the default key. |
"" for the provider | Removes all of its keys. |
Pin a key from a routing target with provider_key_id
(Routing). Each spend row records the key id
that served it (providerKeyId). On the Routing page each target and lane has a Key column:
a picker once the provider holds two or more keys, otherwise default key.