Gateway app credentials

An app can have multiple named gateway credentials. They share the same app controls, limits, prompts and log identity. Issuing or revoking a credential does not create another app.

Credential contract

Property	Rule
Initial credential	App creation always issues one, named Default unless overridden.
Additional credentials	Require a display name and credentials:write.
Names	Trimmed, 1-120 characters, unique case-insensitively among non-revoked keys of the app.
Expiry	Optional RFC 3339 timestamp. Omitted/null creation expiry means no expiry.
Changing expiry	Active credentials only; null clears expiry. Name changes are not supported.
Revocation	Preserves history and releases the name. Other valid keys still work.
Listing	Metadata/fingerprints only.
Revealing	Explicit credentials:read; response is not cacheable. Retained active/expired keys can be retrieved; revoked keys are rejected.

Whole-app disable overrides every credential without revoking it. On re-enable, only credentials still valid under expiry/revocation checks work again. JWT/self-service identity follows its own runtime authentication rules.

Rotate without changing the app

Issue

Create a second named key

Migrate

Move callers to the new key

Revoke

Revoke the old credential

QuilrAI

Retain the new credential in your secret store. credentials:write lets an issuer receive a newly created key, but it does not grant permission to reveal every existing key. Management-key issuance and retrieval follow a different administration contract.

Endpoint reference

GET/apps/{app_name}/keys

List gateway credentials

Read metadata and fingerprints for app credentials, including expired/revoked history. Does not reveal secrets.

REQUIRESread

Path, query & header parameters 3

app_name (path)stringrequired

Trimmed display name. App lookup is case-insensitive within the authenticated tenant. Ambiguous legacy names return 409.

min length: 1max length: 200

limit (query)integeroptional

Items per page.

min: 1max: 200default: 50

cursor (query)stringoptional

Opaque cursor returned by this same collection and filters.

No request body.

curl --request GET \
  'https://management.example.com/llmgateway/management/v1/apps/Support%20Bot/keys?limit=50' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules

POST/apps/{app_name}/keys

Issue a gateway credential

Issue a named key for the existing canonical app. No default expiry. Non-revoked names are unique case-insensitively.

REQUIREScredentials:write

Path, query & header parameters 2

app_name (path)stringrequired

Trimmed display name. App lookup is case-insensitive within the authenticated tenant. Ambiguous legacy names return 409.

min length: 1max length: 200

Idempotency-Key (header)stringrequired

Unique operation key. Reuse only with the identical request; mismatch returns 409.

min length: 1max length: 128

Full request body specification application/json

Initial key uses Default when omitted. Additional key creation requires a name.

namestringrequired

Trimmed, case-insensitively unique among non-revoked keys of this app.

min length: 1max length: 120

expires_atstring | nulloptional

Omit on create or send null for no expiry. On PATCH, omission preserves the current expiry and null removes it. Expired/revoked credentials cannot be resurrected.

Variant 1 string

string

Future RFC 3339 timestamp with an explicit timezone.

format: date-time

Also accepts null.

Unknown fields are rejected in this object.

curl --request POST \
  'https://management.example.com/llmgateway/management/v1/apps/Support%20Bot/keys' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'Idempotency-Key: operation-001' \
  --header 'Content-Type: application/json' \
  --data '{
  "name": "CI automation",
  "expires_at": null
}'

Authentication, errors & retry rules

PATCH/apps/{app_name}/keys/{key_id}

Change gateway key expiry

Only active credentials may change expiry. Null removes expiry; expired/revoked states are terminal. Key name is immutable.

REQUIREScredentials:write

Path, query & header parameters 3

app_name (path)stringrequired

Trimmed display name. App lookup is case-insensitive within the authenticated tenant. Ambiguous legacy names return 409.

min length: 1max length: 200

key_id (path)stringrequired

min length: 1

If-Match (header)stringrequired

Exact quoted ETag from a current resource read.

Full request body specification application/json

expires_atstring | nullrequired

Omit on create or send null for no expiry. On PATCH, omission preserves the current expiry and null removes it. Expired/revoked credentials cannot be resurrected.

Variant 1 string

string

Future RFC 3339 timestamp with an explicit timezone.

format: date-time

Also accepts null.

Unknown fields are rejected in this object.

curl --request PATCH \
  'https://management.example.com/llmgateway/management/v1/apps/Support%20Bot/keys/key_example' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "resource-version"' \
  --header 'Content-Type: application/json' \
  --data '{
  "expires_at": "2027-01-01T00:00:00Z"
}'

Authentication, errors & retry rules

DELETE/apps/{app_name}/keys/{key_id}

Revoke a gateway credential

Idempotently revoke this key, preserve history and release its display name. The app and other valid keys remain available.

REQUIREScredentials:write

Path, query & header parameters 3

app_name (path)stringrequired

Trimmed display name. App lookup is case-insensitive within the authenticated tenant. Ambiguous legacy names return 409.

min length: 1max length: 200

key_id (path)stringrequired

min length: 1

If-Match (header)stringrequired

Exact quoted ETag from a current resource read.

No request body.

curl --request DELETE \
  'https://management.example.com/llmgateway/management/v1/apps/Support%20Bot/keys/key_example' \
  --header 'Authorization: Bearer <management-key>' \
  --header 'If-Match: "resource-version"'

Authentication, errors & retry rules

POST/apps/{app_name}/keys/{key_id}/reveal

Reveal a gateway credential

Explicitly reveal an active or expired retained gateway credential; revoked keys return terminal_key_state. Response is no-store and reveal is audited without the secret.

REQUIREScredentials:read

Path, query & header parameters 2

app_name (path)stringrequired

Trimmed display name. App lookup is case-insensitive within the authenticated tenant. Ambiguous legacy names return 409.

min length: 1max length: 200

key_id (path)stringrequired

min length: 1

No request body.

curl --request POST \
  'https://management.example.com/llmgateway/management/v1/apps/Support%20Bot/keys/key_example/reveal' \
  --header 'Authorization: Bearer <management-key>'

Authentication, errors & retry rules