Add a provider API key

Add an API key from a model provider so its models become available through your OpenLLM key. The provider bills you directly. Available on every plan. Your vault must be unlocked, because the key is encrypted in your browser before it's saved. See Security and vault.

Each row on the API keys tab shows a badge with the surfaces that provider covers.

Add a key

1. Open Providers and select the API keys tab.
2. Select Connect on the provider's row.
3. Paste the key. For AWS Bedrock, fill in Access key ID, Secret access key, and Region (the default is us-east-1).
4. Select Save. The dialog confirms the key is encrypted, and the row shows Encrypted key stored.
5. Select Done.

There's no CLI command for this step. Keys are encrypted with your vault key, which only your browser holds while the vault is unlocked.

OpenLLM doesn't test the key when you save it. A wrong or expired key shows up as an error on the first request that uses it.

Replace or remove a key

To replace a key:

1. On the provider's row, open the ⋯ menu and select View or update key.
2. The dialog shows your stored key, decrypted in this browser. Paste the new one.
3. Select Update.

To remove a key, open the ⋯ menu, select Remove key, and confirm. Requests that route to that provider fail, or move on to the next model in the chain, until you add a key again.

How keys are stored

Your browser encrypts the key with your vault key (AES-256-GCM) and sends only the ciphertext. OpenLLM's servers store that ciphertext and decrypt it in memory for each request that needs it. Each sk-llm key you create carries a wrapped copy of the vault key, which is how the gateway can decrypt your provider keys without your browser. If an sk-llm key leaks, revoke it. See If a key leaks.

Requests that use an API key always run on the hosted gateway, even when they reach OpenLLM through the daemon on your device.

Web search

Web search uses a Brave Search API key. It powers POST /v1/search and the search tool in the OpenLLM MCP server. Model requests don't run searches on their own: if a model wants to search, the tool or agent that called it makes the search call.

To set up web search:

1. Get an API key at api.search.brave.com. Brave offers a free tier.
2. Open Providers, select the Web search tab, and select Connect on Brave Search API.
3. Paste the key (BSAo…) and select Save.
4. Open Configuration and select the Web search tab.
5. Under Search provider, select Brave Search API. It's the only option and the default.
6. If you changed anything, select Save changes.

The footer on that tab shows Connected — credential found for this provider when the key is in place.

To search, send a query with your OpenLLM key:

curl https://www.openllm.sh/v1/search \
  -H "Authorization: Bearer $OPENLLM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "openllm routing", "max_results": 5}'

The body takes query (required), max_results, and country. The response has query and a results list, each with title, url, and, when Brave returns them, snippet and page_age. Searches don't count toward the Free plan's monthly token cap. For the full schema, see API.

Check that it works

1. Call GET https://www.openllm.sh/v1/models with your OpenLLM key and confirm the provider's models are listed.
2. Send a request with one of them, for example "model": "openai/gpt-5".
3. Check that the x-openllm-resolved-model response header names that model.

Common problems

Related

Last updated on