curl --request POST \
--url https://{host}/api/llm-gateway/admin/connections \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"base_url": "<string>",
"model_provider": "<string>",
"name": "<string>",
"api_key": "<string>",
"auth_type": "<string>",
"change_note": "<string>",
"credentials": "<unknown>",
"settings": "<unknown>"
}
'import requests
url = "https://{host}/api/llm-gateway/admin/connections"
payload = {
"base_url": "<string>",
"model_provider": "<string>",
"name": "<string>",
"api_key": "<string>",
"auth_type": "<string>",
"change_note": "<string>",
"credentials": "<unknown>",
"settings": "<unknown>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
base_url: '<string>',
model_provider: '<string>',
name: '<string>',
api_key: '<string>',
auth_type: '<string>',
change_note: '<string>',
credentials: '<unknown>',
settings: '<unknown>'
})
};
fetch('https://{host}/api/llm-gateway/admin/connections', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/api/llm-gateway/admin/connections",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'base_url' => '<string>',
'model_provider' => '<string>',
'name' => '<string>',
'api_key' => '<string>',
'auth_type' => '<string>',
'change_note' => '<string>',
'credentials' => '<unknown>',
'settings' => '<unknown>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{host}/api/llm-gateway/admin/connections"
payload := strings.NewReader("{\n \"base_url\": \"<string>\",\n \"model_provider\": \"<string>\",\n \"name\": \"<string>\",\n \"api_key\": \"<string>\",\n \"auth_type\": \"<string>\",\n \"change_note\": \"<string>\",\n \"credentials\": \"<unknown>\",\n \"settings\": \"<unknown>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{host}/api/llm-gateway/admin/connections")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"base_url\": \"<string>\",\n \"model_provider\": \"<string>\",\n \"name\": \"<string>\",\n \"api_key\": \"<string>\",\n \"auth_type\": \"<string>\",\n \"change_note\": \"<string>\",\n \"credentials\": \"<unknown>\",\n \"settings\": \"<unknown>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{host}/api/llm-gateway/admin/connections")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"base_url\": \"<string>\",\n \"model_provider\": \"<string>\",\n \"name\": \"<string>\",\n \"api_key\": \"<string>\",\n \"auth_type\": \"<string>\",\n \"change_note\": \"<string>\",\n \"credentials\": \"<unknown>\",\n \"settings\": \"<unknown>\"\n}"
response = http.request(request)
puts response.read_body{
"auth_type": "<string>",
"base_url": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"model_provider": "<string>",
"name": "<string>",
"org_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"secret_path": "<string>",
"settings": "<unknown>",
"stores_key_material": true,
"updated_at": "2023-11-07T05:31:56Z",
"created_by_email": "<string>",
"created_by_name": "<string>",
"created_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_change_note": "<string>",
"last_modified_at": "2023-11-07T05:31:56Z",
"last_modified_by_email": "<string>",
"last_modified_by_name": "<string>",
"last_modified_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"key_last4": "<string>"
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}Create a Credential
Stores a new upstream credential. The plaintext api_key (or credentials object) is written to Barndoor’s encrypted secret store and is never returned by any endpoint.
Create the credential first, then reference it from a provider with connection_id. Providers can no longer store their own key.
curl --request POST \
--url https://{host}/api/llm-gateway/admin/connections \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"base_url": "<string>",
"model_provider": "<string>",
"name": "<string>",
"api_key": "<string>",
"auth_type": "<string>",
"change_note": "<string>",
"credentials": "<unknown>",
"settings": "<unknown>"
}
'import requests
url = "https://{host}/api/llm-gateway/admin/connections"
payload = {
"base_url": "<string>",
"model_provider": "<string>",
"name": "<string>",
"api_key": "<string>",
"auth_type": "<string>",
"change_note": "<string>",
"credentials": "<unknown>",
"settings": "<unknown>"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
base_url: '<string>',
model_provider: '<string>',
name: '<string>',
api_key: '<string>',
auth_type: '<string>',
change_note: '<string>',
credentials: '<unknown>',
settings: '<unknown>'
})
};
fetch('https://{host}/api/llm-gateway/admin/connections', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{host}/api/llm-gateway/admin/connections",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'base_url' => '<string>',
'model_provider' => '<string>',
'name' => '<string>',
'api_key' => '<string>',
'auth_type' => '<string>',
'change_note' => '<string>',
'credentials' => '<unknown>',
'settings' => '<unknown>'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{host}/api/llm-gateway/admin/connections"
payload := strings.NewReader("{\n \"base_url\": \"<string>\",\n \"model_provider\": \"<string>\",\n \"name\": \"<string>\",\n \"api_key\": \"<string>\",\n \"auth_type\": \"<string>\",\n \"change_note\": \"<string>\",\n \"credentials\": \"<unknown>\",\n \"settings\": \"<unknown>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{host}/api/llm-gateway/admin/connections")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"base_url\": \"<string>\",\n \"model_provider\": \"<string>\",\n \"name\": \"<string>\",\n \"api_key\": \"<string>\",\n \"auth_type\": \"<string>\",\n \"change_note\": \"<string>\",\n \"credentials\": \"<unknown>\",\n \"settings\": \"<unknown>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{host}/api/llm-gateway/admin/connections")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"base_url\": \"<string>\",\n \"model_provider\": \"<string>\",\n \"name\": \"<string>\",\n \"api_key\": \"<string>\",\n \"auth_type\": \"<string>\",\n \"change_note\": \"<string>\",\n \"credentials\": \"<unknown>\",\n \"settings\": \"<unknown>\"\n}"
response = http.request(request)
puts response.read_body{
"auth_type": "<string>",
"base_url": "<string>",
"created_at": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"model_provider": "<string>",
"name": "<string>",
"org_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"secret_path": "<string>",
"settings": "<unknown>",
"stores_key_material": true,
"updated_at": "2023-11-07T05:31:56Z",
"created_by_email": "<string>",
"created_by_name": "<string>",
"created_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_change_note": "<string>",
"last_modified_at": "2023-11-07T05:31:56Z",
"last_modified_by_email": "<string>",
"last_modified_by_name": "<string>",
"last_modified_by_user_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"key_last4": "<string>"
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}{
"error": {
"message": "retry_on_429_count must be between 0 and 10",
"type": "invalid_request_error"
}
}connection_id.
Choosing the auth method
Themodel_provider and auth_type together determine which fields are
required:
- API key (
auth_typebearer_api_key,x_api_key,azure_api_key, orbedrock_api_key) — passapi_keywith the upstream key. When you omitauth_type, it defaults by provider family (for example,x_api_keyforanthropicandazure_api_keyforazure_openai). - Amazon Bedrock (
auth_typeaws_roleoraws_static_credentials) — pass the role or access-key details undercredentials. For a role, name Barndoor’s principal from Get Barndoor’s AWS principal in the role’s trust policy, and read the external ID with Get AWS trust info. - Google Vertex (
auth_typegoogle_adc,google_service_account, orgoogle_service_account_impersonation) — pass the service-account details undercredentials. - Claude and Codex sign-in passthrough (
claude_oauth,codex_oauth) — these store no secret, so they’re configured on a provider without a credential.
credentials JSON) is written to Barndoor’s encrypted
secret store and is never returned by any subsequent API call. Update or
rotate it later with PUT /admin/connections/{id}.
Example
curl -X POST https://app.barndoor.ai/api/llm-gateway/admin/connections \
-H "Authorization: Bearer $BARNDOOR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "OpenAI Production",
"model_provider": "openai",
"base_url": "https://api.openai.com/v1",
"api_key": "sk-..."
}'
Authorizations
An access token from Barndoor's identity provider, sent as Authorization: Bearer <token>. Use a service-account token from the OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in user's token. The caller needs the admin role in the organization. Gateway API keys (bd-...) are not accepted here.
Body
Provider family this credential is for, such as openai, anthropic, bedrock, or vertex.
The upstream API key. Stored encrypted and never returned.
How the gateway authenticates upstream. Defaults by provider family.
Optional note explaining why this was created. Shown with the record and in the audit log.
Structured credentials for auth types that are not a single key, such as an AWS role or Google credentials. Stored encrypted and never returned.
Response
Created
A credential: an upstream secret that providers reference. The secret itself is never returned.
How the gateway authenticates upstream, for example bearer_api_key, x_api_key, azure_api_key, aws_role, or google_adc.
Internal reference to the stored secret. This is not the secret.
Whether this credential's auth type stores a secret.
Note explaining the last change.
When the last attributed change was made.
Last four characters of the stored key, when the credential holds one.