Add a user to the gateway¶
By the end of this tutorial a teammate will have their own virtual key for the gateway, with a spend limit and rate limit attached, and you will be able to see what they spend.
Prefer clicking through the console instead? See the console walkthrough.
Scaffold status
The step structure below is agreed and stable. Exact commands, manifests and captured output are added as this flow is verified end to end on the live platform — this page deliberately shows no invented output.
Prerequisites¶
- A running gateway — see Deploy an LLM gateway
- Admin access to that gateway
Why virtual keys¶
One provider key shared across a team gives you no attribution and no blast-radius control. A virtual key per person or per application gives you both: revoke one without touching the others, and see exactly what each is spending.
Steps¶
1. Create the key¶
Issue a virtual key scoped to the user or application.
2. Attach a budget¶
Set a spend limit over a window. Requests are refused once the limit is reached, before they leave the gateway.
3. Attach a rate limit¶
Requests or tokens per minute, to stop one runaway client from starving the rest.
4. Scope the models¶
Restrict which models the key may call — a cheap key should not be able to reach an expensive model.
5. Hand it over¶
The recipient needs two things: the gateway base URL and their key. Nothing else.
Keys are credentials
Send a virtual key over a channel you would use for a password. Rotate it if it is ever pasted somewhere it should not be.
Verify¶
Ask the recipient to make one request, then check that it appears in the gateway logs attributed to their key, with token counts and cost recorded.
Clean up¶
Remove everything this tutorial created, in reverse order: