/api/v1/provider-keysAdd provider API key
Stores or ROTATES a provider API key. Body: { orgId, provider, apiKey, projectId?, label? } — `provider` is resolved through the alias table and must be in the hosted-configurable registry (400 UNKNOWN_PROVIDER); `apiKey` must be 8-4096 chars. The plaintext is pushed into Supabase Vault through `vault_create_secret` / `vault_update_secret`; only the `vault_secret_id` pointer and `key_last4` are stored in `provider_keys` (the envelope Vault itself applies is a property of the hosted platform, not of this codebase), and the legacy AES-GCM `encrypted_key`/`iv` columns are cleared so no stale ciphertext remains (AES-256-GCM survives only as the read fallback for pre-2026-04-24 rows). `projectId: null` stores an org-wide default; a non-null `projectId` creates a per-project override that wins at resolution time. If a row already exists for (org, project, provider) it is REWRAPPED in place and returned 200 with `rotated: true`; otherwise 201 with `rotated: false`. The response never contains the plaintext or the vault pointer. ORG-ADMIN ONLY (`requiredRole: "admin"` + `api_keys:create`, because the write path uses a service-role client that bypasses the owner/admin RLS policy). 10 req/min.
Authentication
Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.
Response
200 example
{
"success": true
}All status codes
Code samples
cURL
curl -X POST \ https://evalguard.ai/api/v1/provider-keys \ -H "Authorization: Bearer $EVALGUARD_API_KEY"
TypeScript
// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:
const res = await fetch("https://evalguard.ai/api/v1/provider-keys", {
method: "POST",
headers: { Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}` },
});
console.log(res.status, await res.json());Python
# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:
import os
import requests
headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}
response = requests.request("POST", "https://evalguard.ai/api/v1/provider-keys", headers=headers)
print(response.status_code, response.json())Go
package main
import (
"context"
"fmt"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequestWithContext(context.Background(), "POST", "https://evalguard.ai/api/v1/provider-keys", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
fmt.Println(resp.Status)
}