Provider Keys
Configure upstream AI provider credentials so Kadryn Gateway can route and test provider traffic securely.
Provider keys let Kadryn call upstream AI providers when Gateway routes traffic.
A provider key is not sent by your application on each request. It is stored securely in Kadryn and used by the Gateway runtime when a route selects that provider.
Provider keys vs Kadryn API keys
| Key | Who uses it | Purpose |
|---|---|---|
| Kadryn API key | Your backend sends it to Kadryn. | Authenticates your application to Kadryn. |
| Provider key | Kadryn uses it server-side. | Calls OpenAI, Anthropic, Gemini, Groq or a custom provider. |
A Gateway request requires a Kadryn API key and a ready provider route.
When provider keys are needed
Provider keys are needed when:
- you use Kadryn Gateway;
- Kadryn must forward requests to an AI provider;
- route readiness should be tested;
- provider errors should appear in Logs & Traces;
- policy enforcement depends on provider or model routing.
Provider keys are not required for direct ingest if Kadryn only receives usage data after execution.
Supported provider categories
Your workspace may support:
- OpenAI;
- Anthropic;
- Gemini;
- Groq;
- custom providers.
The exact provider list depends on your product configuration and plan.
Add a provider key
Open:
Developers → Provider keys
or from Gateway:
Developers → Gateway → Provider routes
Then add the provider key and run a test.
Route readiness
Provider route status can include:
| State | Meaning |
|---|---|
ready | The key and route are usable. |
needs_provider_key | A key is missing for the provider route. |
provider_key_error | A key exists but fails validation or usage. |
untested | The route exists but has not been verified with traffic. |
Security rules
Do:
- store provider keys only in Kadryn or a secure secret manager;
- rotate keys if provider access changes;
- test keys after rotation;
- use provider accounts with appropriate permissions;
- monitor provider key errors.
Do not:
- send provider keys in Gateway request metadata;
- expose provider keys in frontend code;
- log provider keys;
- store provider keys in tickets or chat messages;
- confuse provider keys with Kadryn API keys.
Troubleshooting
Gateway says needs_provider_key
Add a key for the provider route.
Gateway says provider_key_error
Check that:
- the provider key is valid;
- provider account is active;
- model access is enabled;
- provider quota is available;
- provider permissions match the request;
- the key was not revoked.
Requests fail only for one model
Check model availability and provider-side access. The key may work, but the selected model may not be available to that provider account.