> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get an API key ## OpenAPI ````yaml api-reference/llm-gateway-openapi.yml get /admin/api-keys/{id} openapi: 3.1.0 info: title: Barndoor LLM Gateway Admin API version: 1.0.0 description: > Configure the Barndoor LLM Gateway programmatically: credentials and providers, model routes and route groups, pricing, routing policies and rules, launch profiles, budgets, rate limits, model access, API keys, and organization-wide governance settings. These are the same APIs the Barndoor app uses under **LLM Management**, and the Barndoor Terraform provider manages its LLM Gateway resources through them. Every endpoint is scoped to the organization of the calling token. ## Base URL ``` https://app.barndoor.ai/api/llm-gateway ``` For a dedicated deployment, replace `app.barndoor.ai` with the host you sign in to. ## Authentication Send an access token from Barndoor's identity provider in the `Authorization` header: ``` Authorization: Bearer ``` For scripts and CI, use a service-account token from the OAuth 2.0 client-credentials grant, as the Terraform provider does. The caller needs the admin role in the organization. The `bd-...` API keys you create with these endpoints are for LLM traffic (`/v1/chat/completions`, `/v1/messages`, and so on), not for these administrative calls. ## Partial updates Most `PUT` endpoints change only the fields you send. Where a field can be cleared, send it as `null`; omitting it leaves it unchanged. The exceptions are called out on the endpoint: `PUT /admin/governance-config` replaces the whole configuration, `PUT /admin/routing-rules/{id}` replaces the whole rule, and `PUT /admin/agent-runtime-profiles/{slug}` replaces the profile's models. ## Errors Errors are returned as JSON: ```json { "error": { "message": "retry_on_429_count must be between 0 and 10", "type": "invalid_request_error" } } ``` contact: name: Barndoor Support url: https://barndoor.ai servers: - url: https://{host}/api/llm-gateway description: Your Barndoor platform host. variables: host: default: app.barndoor.ai description: >- The host serving your Barndoor deployment. Use the default for Barndoor SaaS; for a dedicated deployment, use the host you sign in to. security: - BearerAuth: [] tags: - name: Credentials description: >- Stored upstream secrets (API keys, AWS roles, Google credentials) that providers reference - name: Providers description: Named upstream providers backed by a credential and a model family - name: Model Routes description: >- Map caller-facing aliases to upstream models on one or more providers, with failover order, retries, timeouts, and cooldowns - name: Route Groups description: >- Named sets of model aliases that model access policies can target as one unit - name: Model Pricing description: >- Versioned per-million-token costs used for cost reporting and cost-based budgets - name: Routing Policies description: Model aliases that pick one of several model slots for each request - name: Routing Rules description: >- Plain-English rules that set a minimum slot or forbid slots on a routing policy - name: Launch Profiles description: >- Models and capabilities applied when members start an agent with barndoor run - name: Rate Limits description: Requests-per-minute and tokens-per-minute ceilings - name: Budgets description: Daily, weekly, or monthly token and cost ceilings - name: Model Access description: >- Allowlist and denylist policies for models, providers, aliases, and route groups - name: Governance description: Organization-wide LLM Gateway settings - name: API Keys description: Organization-managed `bd-...` gateway API keys for LLM traffic paths: /admin/api-keys/{id}: get: tags: - API Keys summary: Get an API key operationId: getApiKey parameters: - name: id in: path description: Record ID (UUID) required: true schema: type: string format: uuid responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ApiKey' '401': description: Missing or invalid access token content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Your role does not allow this action content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: No such record in your organization content: application/json: schema: $ref: '#/components/schemas/Error' security: - BearerAuth: [] components: schemas: ApiKey: type: object required: - id - org_id - kind - created_by_user_id - name - key_prefix - scopes - created_at properties: created_at: type: string format: date-time created_by_user_id: type: string format: uuid description: User who created the key. disabled_at: type: - string - 'null' format: date-time description: >- When the key was disabled, if it is. A disabled key is rejected until re-enabled; unlike revocation, this is reversible. expires_at: type: - string - 'null' format: date-time group_name: type: - string - 'null' description: >- IdP group the key is bound to, if any. A key without a group still inherits its assigned user's IdP groups for policy matching. id: type: string format: uuid key_prefix: type: string description: >- First characters of the key, for identifying it. The full key is never returned after creation. kind: $ref: '#/components/schemas/ApiKeyKind' description: >- `user` (assigned to a person), `machine` (a group-bound or service key), or `agent_session` (a short-lived key for a governed agent session). last_used_at: type: - string - 'null' format: date-time description: >- When the key last authenticated a request; null if never used. Updated periodically, so it can lag slightly. name: type: string org_id: type: string format: uuid revoked_at: type: - string - 'null' format: date-time scopes: type: array items: type: string user_id: type: - string - 'null' format: uuid description: User the key is assigned to, if any. Error: type: object required: - error properties: error: type: object required: - message - type properties: message: type: string description: Human-readable explanation of what went wrong. type: type: string description: >- Error category, such as `invalid_request_error`, `authentication_error`, `permission_error`, `not_found_error`, or `conflict_error`. code: type: - string - 'null' description: Machine-readable code, when one applies. example: error: message: retry_on_429_count must be between 0 and 10 type: invalid_request_error ApiKeyKind: type: string description: 'Key category: `user`, `machine`, or `agent_session`.' enum: - user - machine - agent_session securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- An access token from Barndoor's identity provider, sent as `Authorization: Bearer `. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (`bd-...`) are not accepted here. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.