Security
Encrypted provider key storage for managed tenants
Store tenant-owned provider API keys with AES-GCM encryption at rest and honest security wording.
Teams evaluating how LLM Proxy stores BYO provider credentials in management mode.
The problem
Provider API keys are high-value secrets. A management database should not store raw upstream credentials as plaintext rows.
How LLM Proxy helps
LLM Proxy requires a base64 32-byte provider-key encryption key in management mode and encrypts managed provider API keys at rest with AES-GCM and row-bound associated data.
How it works
- Generate a base64 32-byte management.provider_key_encryption_key.
- Configure it as a backend deployment secret.
- Save provider API keys through authenticated management endpoints.
- Let startup migrate existing plaintext rows into encrypted records.
Feature-to-benefit table
| Feature | Why it matters here | Example |
|---|---|---|
| AES-GCM storage | Provider keys are encrypted before database persistence. | Database dumps and direct storage access do not expose raw values. |
| Startup migration | Existing plaintext rows are encrypted and cleared on management startup. | The bridge is bounded to current schema migration. |
| Honest guarantee | Docs describe encrypted-at-rest storage, not zero-knowledge storage. | The runtime decrypts keys when routing upstream. |
Use-case examples
SQLite local profile
A local management database stores encrypted provider key rows.
SQLite hosted profile
A hosted management database at the configured path uses the same encrypted key contract.
Storage exposure reduction
A database backup does not contain raw provider API keys.
Objections and limitations
- The backend must decrypt provider keys to call upstream APIs.
- Losing the encryption key can break access to stored provider keys.
- This does not remove the need for secure deployment secret handling.
FAQ
What is the main job of encrypted provider key storage?
LLM Proxy requires a base64 32-byte provider-key encryption key in management mode and encrypts managed provider API keys at rest with AES-GCM and row-bound associated data.
Who should read this security resource?
Teams evaluating how LLM Proxy stores BYO provider credentials in management mode.
Does this page claim provider performance or pricing advantages?
No. The supported claim is about LLM Proxy's documented routing, configuration, management, security, usage, and deployment contracts. Provider cost, speed, rankings, and benchmark claims are not made here.
Where should setup details come from?
Use the main README and implementation notes for current command, config, and endpoint details. This page summarizes the workflow without replacing LLM Proxy documentation.
What should I read next?
A closely related resource is Keep provider API keys server-side for LLM apps, which covers server-side provider API keys.
Related resources
Use this pattern in LLM Proxy
Start from the canonical API reference, then use the management surface when the workflow needs tenant or provider configuration.
Open API reference