Open Source · Apache 2.0 · v0.1.0

LLM API key management
for modern teams

Provision scoped, trackable, revocable vendor API keys — without a proxy. One leaked key used to mean full org exposure. Not anymore.

Vendors Supported

0ms

Added Latency

100%

Audit Coverage

1 cmd

Docker Deploy

✓ key.provision

sk-proj-...7xKm

audit logged

The Problem

One shared key = full org exposure

Your org has one OpenAI key shared across 100+ developers. No audit trail, no per-developer budgets, no way to revoke one person without rotating for everyone.

✗ No per-developer visibility

✗ Can't revoke individual access

✗ No budget controls per user

✗ No audit trail of key usage

The Solution

Real keys, scoped per developer

KeyGate uses vendor Admin APIs to create scoped projects/workspaces per developer and issue real API keys. Developers talk directly to the vendor — no proxy, no latency, no SDK changes.

✓ Per-developer scoped API keys

✓ Instant revocation at vendor level

✓ Budget caps enforced by vendor

✓ Full audit log with actor & time

Everything you need

Production-ready key management with zero configuration overhead.

🔑

Real Vendor Keys

Not proxy tokens. Developers use real keys directly with vendor SDKs — no SDK changes, no added latency.

👥

Per-Developer Scoping

Each key lives in its own vendor project or workspace, perfectly isolated from other team members.

💰

Budget Controls

Set per-developer USD spending limits enforced at the vendor level. No surprise bills ever.

⏱️

Rate Limiting

Per-key RPM limits enforced by the vendor. Protect shared quotas from runaway scripts.

🔄

Key Rotation

One-click rotate: revoke old, provision new for the same developer. Zero downtime handoff.

📋

Audit Log

Every provision, revoke, rotate, and config change is immutably logged with actor and timestamp.

🏢

Multi-Vendor

OpenAI, Anthropic, Azure OpenAI, Google Vertex AI — all from one unified dashboard.

🐳

Docker-Ready

One command to run the full stack in production. Deploy to AWS, GCP, Azure, or Kubernetes.

Supported Vendors

KeyGate's vendor system is extensible — add custom vendors with a single class.

Vendor	Mechanism	What's Created	Status
🤖 OpenAI	Project + Service Account per developer	`sk-proj-...` API key	Supported
🧠 Anthropic	Workspace + API Key per developer	Workspace-scoped API key	Supported
☁️ Azure OpenAI	Cognitive Services resource per developer	Unique endpoint + Key1	Supported
🔵 Google Vertex	Service Account + IAM binding per developer	JSON credentials file	Supported
+ Custom	Implement BaseVendorProvisioner	Any key format	Extensible

How it works

KeyGate is only involved at key lifecycle time — zero added latency at inference.

Admin triggers provisioning

🖱️

Provision Key

Admin selects User + vendor OpenAI in the dashboard and clicks Provision.

↓

KeyGate orchestrates vendor API calls

⚙️

KeyGate Backend

Validates developer exists and is active

Loads encrypted OpenAI admin credentials

POST /v1/organization/projects → "keygate-ml-user-a3f2c1"

POST /projects/{id}/service_accounts → real API key generated

Stores only metadata — hint, budget, expiry. Never the full key.

Returns real key to admin shown once

↓

Admin shares key with developer

📤

Secure Handoff

Admin securely delivers the key to User via your preferred channel.

↓

Developer uses key directly — no proxy

🚀

Direct to OpenAI

User sets the key in her SDK. Traffic goes straight to OpenAI — KeyGate is not in the request path.

openai.api_key = "sk-proj-..."0ms overhead

API Reference

Base URL: http://localhost:8000 · Swagger: /docs · ReDoc: /redoc

Authentication

🔒 Bearer Token Required

All endpoints except /health and /api/v1/auth/login require a JWT bearer token in the Authorization header.

bash

# Get a token
curl -X POST http://localhost:8000/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "admin@keygate.dev", "password": "changeme"}'

# Use the token
curl -H "Authorization: Bearer <token>" http://localhost:8000/api/v1/developers

Auth

POST /api/v1/auth/login Get JWT access token ▾

Authenticate with email and password to receive a JWT bearer token.

Request Body

emailrequired

string

Admin account email address.

passwordrequired

string

Admin account password.

Request

Response 200

json

{ "email": "admin@keygate.dev", "password": "changeme" }

json

{ "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...", "token_type": "bearer" }

200 OK422 Validation Error

Vendors

POST/api/v1/vendors/configureStore vendor admin credentials▾

Store or update admin API credentials for a vendor. Credentials are encrypted at rest.

✅ Supported vendors

openai, anthropic, azure_openai, google_vertex

Request Body

vendorrequired

string

Vendor identifier.

admin_api_keyrequired

string

Organization-level admin API key from the vendor console.

org_id

string | null

Organization ID (e.g., org-... for OpenAI).

extra_config

object | null

Additional vendor-specific configuration.

Request

json

{
  "vendor": "openai",
  "admin_api_key": "sk-admin-abc123...",
  "org_id": "org-XXXXXXXX"
}

200 OK422 Validation Error

GET/api/v1/vendorsList configured vendors (keys masked)▾

Returns all configured vendors. Admin keys are masked — only a hint is returned.

200 OK

Developers

POST/api/v1/developersRegister a new developer▾

namerequired

string (1–255)

Developer's full name.

emailrequired

string

Developer email address.

team

string

Team name for grouping. Default: "default".

role

string

Organizational role. Default: "developer".

Request

json

{ "name": "Priya Sharma", "email": "priya@company.com", "team": "ml" }

200 OK422 Validation Error

GET/api/v1/developersList developers▾

team

string | null

Filter by team name.

active_only

boolean

Only return active developers. Default: true.

200 OK

DELETE/api/v1/developers/{dev_id}Deactivate + revoke all keys▾

⚠️ Destructive

Deactivates the developer and immediately revokes all their active API keys at the vendor level.

dev_idrequired

path · string

The developer's ID.

200 OK422 Validation Error

Keys

POST/api/v1/keys/provision⚡ Provision a real vendor API key▾

The core endpoint. Creates a scoped vendor project/workspace and provisions a real API key. The key is returned exactly once.

🔑 One-Time Display

The api_key is shown exactly once. Copy it immediately — it's never stored in full by KeyGate.

Request Body

developer_idrequired

string

The developer to provision the key for.

vendorrequired

string

openai, anthropic, azure_openai, google_vertex

budget_limit_usd

number

Max spend in USD. Default: 50.0.

rate_limit_rpm

integer

Requests per minute cap. Default: 60.

expires_in_days

integer

Key TTL in days. Default: 90.

models_allowed

string[] | null

Restrict to specific models e.g. ["gpt-4","gpt-4o"].

description

string

Human-readable note for the audit trail.

Request

Response 200

json

{
  "developer_id": "dev-abc123",
  "vendor": "openai",
  "budget_limit_usd": 100,
  "rate_limit_rpm": 120,
  "expires_in_days": 90,
  "models_allowed": ["gpt-4", "gpt-4o"],
  "description": "GPT-4 for ML experiments"
}

json

{
  "key_id": "key-xyz789",
  "vendor": "openai",
  "api_key": "sk-proj-...",
  "key_hint": "sk-proj-...7xKm",
  "project_name": "keygate-ml-priya-a3f2c1",
  "budget_limit_usd": 100,
  "expires_at": "2026-06-22T08:00:00+00:00",
  "instructions": {
    "base_url": "https://api.openai.com/v1",
    "auth_header": "Authorization: Bearer <your-key>"
  }
}

200 OK422 Validation Error

GET/api/v1/keysList issued keys (metadata only)▾

Returns key metadata. Full key values are never included.

vendor

string | null

Filter by vendor.

developer_id

string | null

Filter by developer.

status

string

Filter by status. Default: "active".

200 OK

POST/api/v1/keys/{key_id}/revokeRevoke a key immediately▾

Calls the vendor API to delete/disable the key, then marks it revoked locally. Revocation is immediate at the vendor level.

200 OK422 Validation Error

POST/api/v1/keys/{key_id}/rotateRotate — revoke old, provision new▾

Atomically revokes the existing key and provisions a fresh one for the same developer and vendor. Response identical to POST /keys/provision.

200 OK422 Validation Error

Audit & System

GET/api/v1/auditQuery the audit log▾

Immutable log of all provisioning, revocation, and configuration events.

limit

integer (max 500)

Number of events. Default: 50.

action

string | null

Filter by action type, e.g. key.provision.

200 OK

GET/healthHealth check — no auth required▾

Liveness probe for load balancers and container orchestrators.

json

{ "status": "healthy", "service": "keygate", "version": "0.1.0" }

200 OK

Quick Start

Get KeyGate running in under 5 minutes.

Clone and configure

Clone the repository and copy the example environment file.

bash

git clone https://github.com/Aakashbhardwaj27/keygate.git
cd keygate && cp .env.example .env

Edit .env with required values

bash

SECRET_KEY=$(openssl rand -hex 32)
ADMIN_EMAIL=admin@yourcompany.com
ADMIN_PASSWORD=<strong-password>
DB_PASSWORD=<strong-password>
OPENAI_ADMIN_KEY=sk-admin-...

Start the stack

bash

docker compose up -d
# Dashboard → http://localhost:3000
# API docs  → http://localhost:8000/docs

Configure a vendor & provision your first key

Log in, add your vendor admin key, register a developer, click Provision Key. Copy the key — it's shown exactly once.

Configuration Reference

Variable	Required	Description
`DATABASE_URL`	Yes	PostgreSQL connection string
`SECRET_KEY`	Yes	JWT signing key (openssl rand -hex 32)
`ADMIN_EMAIL`	Yes	Initial admin email
`ADMIN_PASSWORD`	Yes	Initial admin password
`OPENAI_ADMIN_KEY`	No	OpenAI org admin API key
`ANTHROPIC_ADMIN_KEY`	No	Anthropic admin API key
`AZURE_SUBSCRIPTION_ID`	No	Azure subscription ID
`GCP_PROJECT_ID`	No	Google Cloud project ID

Deployment Options

🐳

Docker Compose

One command to run the full stack with Postgres and Nginx included.

Recommended

🟠

AWS ECS + RDS

ECS services backed by RDS PostgreSQL with Application Load Balancer for HTTPS.

Cloud

🔵

GCP Cloud Run

Serverless containers with Cloud SQL. Perfect for variable load workloads.

Cloud

⚙️

Kubernetes

Kubernetes manifests included. Helm chart on roadmap for v0.2.0.

K8s

Changelog

All notable changes to KeyGate are documented here.

v0.1.0

Mar 2026

Initial Release 🎉

NEWNEWNEW

OpenAI provisioner — Project + Service Account per developer
Anthropic provisioner — Workspace + API Key per developer
Azure OpenAI provisioner — Cognitive Services resource per developer
Google Vertex AI — Service Account + IAM binding per developer
Full audit log with actor, timestamp, event details
JWT authentication with configurable expiry
Key rotation (revoke old + provision new atomically)
Workspace and team management
Docker Compose production stack
React dashboard frontend

v0.2.0

Roadmap

Upcoming

Prometheus /metrics endpoint
SSO/SAML integration (Okta, Auth0, Google Workspace)
Self-service developer portal with approval flows
Spend tracking via vendor usage APIs
Slack/Teams notifications on key events
Helm chart for Kubernetes
CLI: keygate provision --vendor openai --dev priya
Webhook support for key lifecycle events

LLM API key managementfor modern teams

One shared key = full org exposure

Real keys, scoped per developer

Real Vendor Keys

Per-Developer Scoping

Budget Controls

Rate Limiting

Key Rotation

Audit Log

Multi-Vendor

Docker-Ready

API Reference

Authentication

Auth

Request Body

Vendors

Request Body

Developers

Keys

Request Body

Audit & System

Clone and configure

Edit .env with required values

Start the stack

Configure a vendor & provision your first key

Configuration Reference

Deployment Options

Docker Compose

AWS ECS + RDS

GCP Cloud Run

Kubernetes

Initial Release 🎉

Upcoming

LLM API key management
for modern teams