Master Keys & Provisioning API
Provision projects and keys from your own backend
Multi-tenant platforms and internal developer portals need to create projects and API keys as part of their own onboarding, not by asking someone to click through the dashboard. Master keys are organization-scoped bearer tokens built for that. From your backend, create and update projects, issue gateway API keys with lifetime and recurring spend limits, attach IAM rules to keys and organization members, and register custom providers and models. The same tokens expose usage and cost reporting, so per-member and per-model spend flows into your own dashboards, warehouse, or chargeback process. Master keys are stored as HMAC-SHA256 hashes, shown in plain text only once, scoped to a single organization, and every create, delete, and status change lands in Enterprise Audit Logs.
Why teams turn it on
Provisioning as code
Create projects, issue gateway API keys, and set IAM rules from the systems that already onboard your tenants.
Spend limits on every key
Give keys a lifetime cap or a recurring hourly, daily, weekly, or monthly window, and read usage back against it.
Cost reporting built in
Pull per-member and per-model usage and cost for chargeback without exporting from the dashboard.
Revocable and audited
Hashed at rest, scoped to one organization, revoked the moment you deactivate them, and recorded in the audit log.
How it works
From decision to deployed in three short steps
- 01
Create a master key
Under Organization → Master Keys, create a key and copy the token. It is shown once.
- 02
Call the API
Send it as Authorization: Bearer llmgmk_... to the /v1/master/* endpoints.
- 03
Rotate or revoke
Deactivate or delete a key to cut off programmatic access immediately.
bash
List projects with a master key
curl https://internal.llmgateway.io/v1/master/projects \
-H "Authorization: Bearer $MASTER_KEY"Real-world use cases
Why customers actually adopt this
Multi-tenant SaaS
Create a project and key for every customer at signup, with a spend cap that matches their plan.
Internal developer portals
Let engineers request a key from your own portal, with IAM rules applied automatically.
Finance chargeback
Pull monthly cost per member and model into the systems that bill teams.
Frequently asked
- Does programmatic creation bypass limits?
- No. Project and API-key creation enforces the same per-organization and per-project limits as the dashboard.
- Can a master key reach another organization?
- No. Each master key is scoped to a single organization and cannot access resources in any other.
- How many master keys can an organization have?
- Up to 10, counting active and inactive keys. Only deleting a key frees a slot.
More enterprise capabilities
The rest of the enterprise stack
Organization-Wide Analytics
Cost, requests, and tokens totaled across every project, with breakdowns by model, project, API key, and member. Built on pre-aggregated rollups, so any date range stays fast.
Per-Member Budgets & Developer Role
Per-member spend caps enforced at request time, org-wide default developer limits, and a project-scoped Developer role. An over-budget request is rejected before it ever reaches a provider.
Teams & Directory Sync
Group developers under a shared project ceiling, per-developer budgets, and IAM rules. Microsoft Entra groups map onto teams over SCIM.
Enterprise Audit Logs
Tamper-evident audit trails for SOC 2, HIPAA, ISO 27001, and internal investigations. Every config change, key rotation, and admin action — captured, attributed, exportable.
Data Streams to Your SIEM
Forward audit logs to your SIEM and export request log metadata to your own HTTPS endpoint in signed, ordered batches, with replay of up to 30 days.
Per-Project Routing Overrides
Override global routing rules at the project level — region, provider order, fallback chain, and cost ceilings. Production stays pinned; experimental teams stay flexible.
Dynamic Routes
Named, versioned routing flows with conditions, classifier branches, A/B splits, and model targets. Call one with dynamic/<name> and roll back instantly.
Enterprise Guardrails
Server-side detection for prompt injection, PII, secrets, and policy violations. Configured centrally, enforced at the gateway, auditable per-request.
Provider Compliance Policies
Require SOC 2, ISO 27001, GDPR, zero data retention, no prompt training, or approved headquarters countries, and the gateway refuses every provider that falls short.
Zero Data Retention
Enforce zero data retention across provider routing, gateway storage, response caches, and the Responses API, for the whole organization or a single API key.
Discord & Slack Alerts
Native webhook integrations for Discord and Slack. Get the enterprise contact-sales form, billing events, guardrail trips, and SLA breaches in the channels your team already monitors.
Single Sign-On (SAML / OIDC)
SAML 2.0 and OIDC SSO with SCIM provisioning, group-based role mapping, and enforced-only access. No local credentials, no shared passkeys, no off-boarding gaps.
Organization Skills
Publish shared agent skills once and let developers install them into Claude Code, Codex, Cursor, OpenCode, and other agents with one CLI command.
White-Label Chat & Playground
Embed or stand up a fully white-labeled chat app and playground under your own domain. Customize branding, default models, system prompts, and feature toggles.
See master keys & provisioning api on your real workloads
Bring a sample workload to a 30-minute call. We'll wire it up live and show you the actual experience your team will get.