> ## Documentation Index > Fetch the complete documentation index at: https://docs.barndoor.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create a Provider > Creates a new named provider. Either supply a `connection_id` to share an existing credential, or supply `api_key` / `credentials` to create an inline secret as part of the request. Pass `models` to enable a list of upstream model names as 1:1 routes in the same call — equivalent to creating each route individually afterwards. A **Provider** is a named upstream that authenticates with one credential and serves a model family. Provider creation supports two modes: * **Inline credential** — pass `api_key` (or `credentials`) directly. Barndoor stores the secret in its encrypted secret store, scoped to this provider. * **Shared credential** — pass `connection_id` referencing an existing [Credential](/api-reference/llm-gateway/credentials/listCredentials). The provider's `auth_type`, `base_url`, and settings inherit from the shared record. ## Auto-enabling models in one call Pass a list of upstream model names in `models` and Barndoor will create a 1:1 [Model Route](/api-reference/llm-gateway/model-routes/listAllRoutes) for each one in the same call. The route's alias matches the upstream model name so callers can address it as `/`. Add bare-name aliases or failover routes afterwards via the Model Routes endpoints. ## Example ```bash theme={null} curl -X POST https://app.barndoor.ai/api/llm-gateway/admin/providers \ -H "Authorization: Bearer $BARNDOOR_JWT" \ -H "Content-Type: application/json" \ -d '{ "name": "OpenAI Production (US)", "model_provider": "openai", "base_url": "https://api.openai.com/v1", "connection_id": "4f8b2a3c-12ee-4d92-9c7b-e7d2f8b0a111", "models": ["gpt-4o-mini", "gpt-4o", "text-embedding-3-large"] }' ``` See the [Quickstart Guide](/how-tos/llm-gateway-quickstart#step-2-create-a-provider) for the full walkthrough. ## OpenAPI ````yaml api-reference/llm-gateway-openapi.yml post /admin/providers openapi: 3.1.0 info: title: Barndoor LLM Gateway API version: 1.0.0 description: > REST API for the Barndoor LLM Gateway: configure providers, model routes, pricing, governance, and operate a multi-provider LLM platform programmatically. All endpoints in this document are scoped to your organization. They are the same APIs powering the Barndoor portal under **LLM Configuration**, **LLM Controls**, and **Settings - My Models**, exposed for teams that prefer scripting over the UI. ## Base URL All requests are issued against your Barndoor instance: ``` https://app.barndoor.ai/api/llm-gateway ``` Replace `app.barndoor.ai` with your tenant host if you run on Enterprise. ## Authentication Endpoints accept a JWT Bearer token issued by your Barndoor identity provider. Tokens can be obtained interactively via the Barndoor SDK: ```ts const sdk = await loginInteractive(); ``` The token must be sent in the `Authorization` header on every request: ``` Authorization: Bearer eyJhbGciOi... ``` Note: the `bd-...` API keys you create through these endpoints are for runtime LLM traffic (`/v1/chat/completions`, `/v1/messages`, etc.), not for administrative calls. Administrative endpoints require a user/admin JWT. ## Permissions Most endpoints require an `admin` (or higher) role on the calling user. Read-only endpoints are typically accessible by all authenticated users. Read-only listings under `/user/...` are scoped to the authenticated user. ## Errors Errors are returned as JSON with a stable shape: ```json { "error": "BadRequest", "message": "request_timeout_secs must be between 1 and 3600" } ``` contact: name: Barndoor Support url: https://barndoor.ai servers: - url: https://{host}/api/llm-gateway description: >- Production / Trial (Barndoor SaaS). The gateway lives on your Barndoor control-plane host. For Enterprise or self-hosted deployments, replace the host with your portal hostname — the authoritative value is shown on Settings → My Models in the portal. variables: host: description: Your Barndoor control-plane (portal) hostname default: app.barndoor.ai - url: https://app.barndooruat.com/api/llm-gateway description: UAT - url: https://app.barndoordev.com/api/llm-gateway description: Dev security: - BearerAuth: [] tags: - name: Credentials description: >- Reusable upstream credentials (API keys, AWS roles, Vertex service accounts) - name: Providers description: Named upstream providers backed by credentials and a model family - name: Provider Catalog description: Read-only catalog of supported upstream provider templates - name: Model Routes description: Map client-facing aliases to one or more upstream provider/model pairs - name: Model Pricing description: Per-million-token input/output costs for usage and budget reporting - name: Rate Limits description: Requests-per-minute and tokens-per-minute caps - name: Token Budgets description: Daily, weekly, or monthly token and cost ceilings - name: Model Access description: Allowlist or denylist policies for models, providers, or aliases - name: Smart Models description: Routing policies that pick a target model based on the request - name: Governance Configuration description: Org-wide behavior toggles for the LLM Gateway - name: Route Health description: Operational view of upstream route ejection and recovery - name: API Keys description: Org-managed gateway API keys (the `bd-...` keys callers send on `/v1/...`) - name: User description: Self-service endpoints for the authenticated user paths: /admin/providers: post: tags: - Providers summary: Create a provider description: | Creates a new named provider. Either supply a `connection_id` to share an existing credential, or supply `api_key` / `credentials` to create an inline secret as part of the request. Pass `models` to enable a list of upstream model names as 1:1 routes in the same call — equivalent to creating each route individually afterwards. operationId: createProvider requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateProviderRequest' responses: '200': description: The newly created provider content: application/json: schema: $ref: '#/components/schemas/Provider' '400': $ref: '#/components/responses/BadRequest' components: schemas: CreateProviderRequest: type: object required: - name - model_provider - base_url properties: name: type: string model_provider: $ref: '#/components/schemas/ModelProviderSlug' auth_type: $ref: '#/components/schemas/AuthType' base_url: type: string api_key: type: string format: password description: Required for direct API-key auth when no `connection_id` is provided catalog_id: type: string format: uuid description: Optional reference to a provider catalog template connection_id: type: string format: uuid description: Optional reference to a shared Credentials record models: type: array description: | Upstream models to enable on this provider as 1:1 model routes. Each entry creates a route where the alias equals the upstream model name (so callers can address it as `/`). items: type: string example: - gpt-4o-mini - gpt-4o settings: type: object additionalProperties: true credentials: type: object description: Structured non-API-key credentials (AWS keys, Vertex SA JSON, etc.) additionalProperties: true request_timeout_secs: type: integer nullable: true minimum: 1 maximum: 3600 stream_idle_timeout_secs: type: integer nullable: true minimum: 1 maximum: 1800 Provider: type: object description: A named upstream provider backed by a credential and a model family. required: - id - org_id - name - model_provider - auth_type - base_url - enabled - settings - created_at - updated_at properties: id: type: string format: uuid org_id: type: string format: uuid catalog_id: type: string format: uuid nullable: true description: Reference to a built-in provider catalog template, if used connection_id: type: string format: uuid nullable: true description: Reference to a shared Credentials record, if any name: type: string example: OpenAI Production (US) model_provider: $ref: '#/components/schemas/ModelProviderSlug' auth_type: $ref: '#/components/schemas/AuthType' base_url: type: string format: uri enabled: type: boolean default: true settings: type: object additionalProperties: true request_timeout_secs: type: integer nullable: true minimum: 1 maximum: 3600 description: | Provider-tier total-request timeout override. When `null` (the default) the gateway inherits the platform default. Affects every route served by this provider unless a more specific Model Route value overrides it. stream_idle_timeout_secs: type: integer nullable: true minimum: 1 maximum: 1800 description: | Maximum allowed idle gap between streamed response chunks. `null` inherits the platform default. catalog_slug: type: string nullable: true description: Catalog slug shorthand used in some response listings ModelProviderSlug: type: string description: Slug of the upstream model provider this resource speaks to enum: - openai - anthropic - azure_openai - google_ai - bedrock - vertex - groq - together - mistral - cohere - xai - fireworks - perplexity - openrouter - deepseek - custom example: openai AuthType: type: string description: > The authentication scheme this credential or provider uses to talk to the upstream model provider. Valid values depend on `model_provider`: for OpenAI/Anthropic-style vendors this is typically `api_key`; for AWS Bedrock it is one of `aws_role`, `aws_keys`, or `bedrock_api_key`; for Google Vertex it is `google_adc`, `google_service_account`, or `google_impersonation`; Anthropic OAuth passthrough uses `oauth_passthrough`. example: api_key Error: type: object required: - error - message properties: error: type: string description: A short machine-readable error code example: BadRequest message: type: string description: A human-readable description of what went wrong example: request_timeout_secs must be between 1 and 3600 responses: BadRequest: description: The request body or query parameters were invalid content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT description: | JWT obtained through Barndoor's authentication flow. Pass the token verbatim in `Authorization: Bearer `. Use the Barndoor SDK's `loginInteractive()` helper to obtain a token in scripts and notebooks. ````