> ## Documentation Index
> Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a Credential

> Stores a new upstream credential. The plaintext `api_key` (or `credentials` object) is written to Barndoor's encrypted secret store and is never returned by any endpoint.

Create the credential first, then reference it from a provider with `connection_id`. Providers can no longer store their own key.

Create a reusable upstream credential. One credential can back many providers
(for example, a single OpenAI key shared across multiple environments or
routes). Providers can't store their own key: create the credential first, then
reference it from [Create a provider](/api-reference/llm-gateway/providers/createProvider)
with `connection_id`.

## Choosing the auth method

The `model_provider` and `auth_type` together determine which fields are
required:

* **API key** (`auth_type` `bearer_api_key`, `x_api_key`, `azure_api_key`, or
  `bedrock_api_key`) — pass `api_key` with the upstream key. When you omit
  `auth_type`, it defaults by provider family (for example, `x_api_key` for
  `anthropic` and `azure_api_key` for `azure_openai`).
* **Amazon Bedrock** (`auth_type` `aws_role` or `aws_static_credentials`) — pass
  the role or access-key details under `credentials`. For a role, name Barndoor's
  principal from [Get Barndoor's AWS principal](/api-reference/llm-gateway/credentials/getAwsRoleConfig)
  in the role's trust policy, and read the external ID with
  [Get AWS trust info](/api-reference/llm-gateway/credentials/getAwsTrustInfo).
* **Google Vertex** (`auth_type` `google_adc`, `google_service_account`, or
  `google_service_account_impersonation`) — pass the service-account details under
  `credentials`.
* **Claude and Codex sign-in passthrough** (`claude_oauth`, `codex_oauth`) — these
  store no secret, so they're configured on a provider without a credential.

The plaintext key (or `credentials` JSON) is written to Barndoor's encrypted
secret store and is never returned by any subsequent API call. Update or
rotate it later with [`PUT /admin/connections/{id}`](/api-reference/llm-gateway/credentials/updateCredential).

## Example

```bash theme={null}
curl -X POST https://app.barndoor.ai/api/llm-gateway/admin/connections \
  -H "Authorization: Bearer $BARNDOOR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "OpenAI Production",
    "model_provider": "openai",
    "base_url": "https://api.openai.com/v1",
    "api_key": "sk-..."
  }'
```

<Note>
  For a guided walkthrough, see [Configure the Gateway](/how-tos/llm-gateway-quickstart#admin-configure-the-gateway).
</Note>


## OpenAPI

````yaml api-reference/llm-gateway-openapi.yml post /admin/connections
openapi: 3.1.0
info:
  title: Barndoor LLM Gateway Admin API
  version: 1.0.0
  description: >
    Configure the Barndoor LLM Gateway programmatically: credentials and
    providers,

    model routes and route groups, pricing, routing policies and rules, launch
    profiles,

    budgets, rate limits, model access, API keys, and organization-wide
    governance settings.


    These are the same APIs the Barndoor app uses under **LLM Management**, and
    the

    Barndoor Terraform provider manages its LLM Gateway resources through them.
    Every

    endpoint is scoped to the organization of the calling token.


    ## Base URL


    ```

    https://app.barndoor.ai/api/llm-gateway

    ```


    For a dedicated deployment, replace `app.barndoor.ai` with the host you sign
    in to.


    ## Authentication


    Send an access token from Barndoor's identity provider in the
    `Authorization` header:


    ```

    Authorization: Bearer <access-token>

    ```


    For scripts and CI, use a service-account token from the OAuth 2.0
    client-credentials

    grant, as the Terraform provider does. The caller needs the admin role in
    the

    organization.


    The `bd-...` API keys you create with these endpoints are for LLM traffic

    (`/v1/chat/completions`, `/v1/messages`, and so on), not for these
    administrative calls.


    ## Partial updates


    Most `PUT` endpoints change only the fields you send. Where a field can be
    cleared,

    send it as `null`; omitting it leaves it unchanged. The exceptions are
    called out on

    the endpoint: `PUT /admin/governance-config` replaces the whole
    configuration,

    `PUT /admin/routing-rules/{id}` replaces the whole rule, and

    `PUT /admin/agent-runtime-profiles/{slug}` replaces the profile's models.


    ## Errors


    Errors are returned as JSON:


    ```json

    { "error": { "message": "retry_on_429_count must be between 0 and 10",
    "type": "invalid_request_error" } }

    ```
  contact:
    name: Barndoor Support
    url: https://barndoor.ai
servers:
  - url: https://{host}/api/llm-gateway
    description: Your Barndoor platform host.
    variables:
      host:
        default: app.barndoor.ai
        description: >-
          The host serving your Barndoor deployment. Use the default for
          Barndoor SaaS; for a dedicated deployment, use the host you sign in
          to.
security:
  - BearerAuth: []
tags:
  - name: Credentials
    description: >-
      Stored upstream secrets (API keys, AWS roles, Google credentials) that
      providers reference
  - name: Providers
    description: Named upstream providers backed by a credential and a model family
  - name: Model Routes
    description: >-
      Map caller-facing aliases to upstream models on one or more providers,
      with failover order, retries, timeouts, and cooldowns
  - name: Route Groups
    description: >-
      Named sets of model aliases that model access policies can target as one
      unit
  - name: Model Pricing
    description: >-
      Versioned per-million-token costs used for cost reporting and cost-based
      budgets
  - name: Routing Policies
    description: Model aliases that pick one of several model slots for each request
  - name: Routing Rules
    description: >-
      Plain-English rules that set a minimum slot or forbid slots on a routing
      policy
  - name: Launch Profiles
    description: >-
      Models and capabilities applied when members start an agent with barndoor
      run
  - name: Rate Limits
    description: Requests-per-minute and tokens-per-minute ceilings
  - name: Budgets
    description: Daily, weekly, or monthly token and cost ceilings
  - name: Model Access
    description: >-
      Allowlist and denylist policies for models, providers, aliases, and route
      groups
  - name: Governance
    description: Organization-wide LLM Gateway settings
  - name: API Keys
    description: Organization-managed `bd-...` gateway API keys for LLM traffic
paths:
  /admin/connections:
    post:
      tags:
        - Credentials
      summary: Create a credential
      description: >-
        Stores a new upstream credential. The plaintext `api_key` (or
        `credentials` object) is written to Barndoor's encrypted secret store
        and is never returned by any endpoint.


        Create the credential first, then reference it from a provider with
        `connection_id`. Providers can no longer store their own key.
      operationId: createCredential
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateConnectionRequest'
        required: true
      responses:
        '200':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connection'
        '400':
          description: Invalid request. The error message says which field or rule failed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing or invalid access token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Your role does not allow this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '409':
          description: Another record already uses this name
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - BearerAuth: []
components:
  schemas:
    CreateConnectionRequest:
      type: object
      required:
        - name
        - model_provider
        - base_url
      properties:
        api_key:
          type:
            - string
            - 'null'
          description: The upstream API key. Stored encrypted and never returned.
        auth_type:
          type:
            - string
            - 'null'
          description: How the gateway authenticates upstream. Defaults by provider family.
        base_url:
          type: string
        change_note:
          type:
            - string
            - 'null'
          description: >-
            Optional note explaining why this was created. Shown with the record
            and in the audit log.
        credentials:
          description: >-
            Structured credentials for auth types that are not a single key,
            such as an AWS role or Google credentials. Stored encrypted and
            never returned.
        model_provider:
          type: string
          description: >-
            Provider family this credential is for, such as `openai`,
            `anthropic`, `bedrock`, or `vertex`.
        name:
          type: string
        settings: {}
    Connection:
      allOf:
        - $ref: '#/components/schemas/ChangeAttribution'
        - type: object
          required:
            - id
            - org_id
            - name
            - model_provider
            - auth_type
            - base_url
            - secret_path
            - settings
            - stores_key_material
            - created_at
            - updated_at
          properties:
            auth_type:
              type: string
              description: >-
                How the gateway authenticates upstream, for example
                `bearer_api_key`, `x_api_key`, `azure_api_key`, `aws_role`, or
                `google_adc`.
            base_url:
              type: string
            created_at:
              type: string
              format: date-time
            id:
              type: string
              format: uuid
            key_last4:
              type:
                - string
                - 'null'
              description: >-
                Last four characters of the stored key, when the credential
                holds one.
            model_provider:
              type: string
            name:
              type: string
            org_id:
              type: string
              format: uuid
            secret_path:
              type: string
              description: Internal reference to the stored secret. This is not the secret.
            settings: {}
            stores_key_material:
              type: boolean
              description: Whether this credential's auth type stores a secret.
            updated_at:
              type: string
              format: date-time
      description: >-
        A credential: an upstream secret that providers reference. The secret
        itself is never returned.
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - message
            - type
          properties:
            message:
              type: string
              description: Human-readable explanation of what went wrong.
            type:
              type: string
              description: >-
                Error category, such as `invalid_request_error`,
                `authentication_error`, `permission_error`, `not_found_error`,
                or `conflict_error`.
            code:
              type:
                - string
                - 'null'
              description: Machine-readable code, when one applies.
      example:
        error:
          message: retry_on_429_count must be between 0 and 10
          type: invalid_request_error
    ChangeAttribution:
      type: object
      description: >-
        Who created and last changed the record, and why. Records created before
        attribution was added have no values until their next change.
      properties:
        created_by_email:
          type:
            - string
            - 'null'
        created_by_name:
          type:
            - string
            - 'null'
        created_by_user_id:
          type:
            - string
            - 'null'
          format: uuid
        last_change_note:
          type:
            - string
            - 'null'
          description: Note explaining the last change.
        last_modified_at:
          type:
            - string
            - 'null'
          format: date-time
          description: When the last attributed change was made.
        last_modified_by_email:
          type:
            - string
            - 'null'
        last_modified_by_name:
          type:
            - string
            - 'null'
        last_modified_by_user_id:
          type:
            - string
            - 'null'
          format: uuid
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        An access token from Barndoor's identity provider, sent as
        `Authorization: Bearer <token>`. Use a service-account token from the
        OAuth 2.0 client-credentials grant for scripts and CI, or a signed-in
        user's token. The caller needs the admin role in the organization.
        Gateway API keys (`bd-...`) are not accepted here.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.