Select Where to Keep Your Provider Key
Verdictan calls models with your own provider account. An OpenAI request uses your OpenAI key and your OpenAI credit. Verdictan calls this method bring your own key (BYOK). This article helps you to select where the gateway gets the key. Connect Your Model Provider gives the full procedure.
The gateway must have a provider key before it can forward a request. A model in the Verdictan catalog is not available to you until your provider account has access to it and has credit.
Keep the three credentials different
The provider key is one of three credentials:
| Credential | Use |
|---|---|
| Provider key | The gateway sends it to the upstream model provider. |
| Gateway token | It connects the gateway to Verdictan. |
| Application token | It authorizes the requests of your application. |
Keep all three credentials different.
Compare the key locations
| Location | Use it for |
|---|---|
| Environment variable | A test on your computer, or a gateway that gets its secrets from your own secret manager |
| Saved organization secret | One key that more than one connected gateway shares |
| Cloud identity | Providers such as Bedrock or Vertex AI. See Cloud Provider Configuration. |
Refer to the key in the policy config
Each provider target finds its key through secret_key_ref. The reference takes one source:
| Source | Reference |
|---|---|
| Environment variable on the gateway host | env: OPENAI_API_KEY |
| Saved organization secret | store: OPENAI_API_KEY |
The env name must be the same as the name of the variable that you set for the gateway process. To use an external secret manager, put the key in the gateway environment and use env. Do not put a key value in YAML or in a literal authorization header.
Give an agent access to a saved key
A saved key is not available to an agent until a role gives that agent access. The setup flow gives access to the default Assistant agent only. For each other agent, attach a role that contains a policy that allows the agent to read the secret.
A provider-access simulation examines authorization only. Send one model request through the agent URL to verify the key, the model access, and the connection.
Replace a key
- Create a new key with your provider.
- Put the new key in its source.
- If the gateway reads an environment variable, stop the gateway and start it again.
- Send a small test request through Verdictan.
- Revoke the old key with your provider.
Next steps
- Connect Your Model Provider: save a key, attach a role, and read the simulation result.
- Provider Configuration: add models and configure routing and fallback.
- Usage Costs and Budgets: set cost limits after the first request is successful.