Overview

The Allternit LLM gateway uses virtual keys for authentication. Each virtual key is a scoped, rotatable credential that maps to a tenant, organization, or user profile. Virtual keys are used for all public /v1 gateway routes, including chat completions, embeddings, files, and batches. Organization-scoped admin routes under /api/v1/gateway/* require a Clerk JWT and appropriate organization role (owner or admin).

Virtual keys

Virtual keys start with ak-. The gateway stores only the SHA-256 hash of the key; the plaintext is shown once at creation and cannot be recovered.

Base URL

For local development:

Create a virtual key

This endpoint requires a Clerk JWT and organization owner or admin role.

Request body

Example response

List virtual keys

Update a virtual key

Revoke a virtual key

Authentication errors

Security best practices

Never commit virtual keys to version control.
  • Store keys in environment variables or a secrets manager.
  • Rotate keys regularly and revoke unused keys.
  • Use separate keys for production, staging, and development.
  • Set monthly_budget_cents and rate_limit_rpm on every key.
  • Restrict allowed_models to the smallest set required.