Management UI
Self-service LLM key management for internal teams
Sign in to create tenants, reuse provider connections, and select models from one dashboard.
Teams that want user-owned AI access without asking operators to edit YAML for every change.
The problem
Operator-provisioned AI access does not scale when each user or team needs provider keys, defaults, generated secrets, and examples updated separately.
How LLM Proxy helps
The authenticated dashboard presents tenants, connections, and models. An account owns connections, while each tenant retains its access key, defaults, prompts, and usage.
How it works
- Configure TAuth, the management database, and provider-key encryption.
- Publish the static Pages UI and serve runtime config from the API backend.
- Sign in and select or create a tenant.
- Connect an existing provider connection or create one with verified credentials.
Feature-to-benefit table
| Feature | Why it matters here | Example |
|---|---|---|
| TAuth-gated UI | Management controls appear only after login. | Unauthenticated users see the sign-in state, not tenant controls. |
| Explicit client access | Create an API key from the selected tenant details. | Tenant setup can continue later. |
| Reusable connections | Connection cards show the provider, connection name, and assigned tenant count. | Connect assigns one connection per provider to the selected tenant. |
| Copyable examples | The text request example uses the saved default route and the generated-secret placeholder. | Tenant access keeps the one-time key separate. |
Use-case examples
New team onboarding
A user creates FamilyHome, connects an existing OpenAI connection, and saves a text default.
Provider update
A user selects a DeepSeek model and explicitly saves the tenant default.
Usage review
The user returns to the dashboard and selects all-time, 30-day, 7-day, or 1-day request and token summaries.
Objections and limitations
- Management requires configured TAuth, CORS origins, database settings, and a provider-key encryption key.
- The backend serves management APIs and runtime config; the static Pages app is only the shell.
- The card shows only a generic saved-key mask and never retrieves the stored raw credential.
Repository evidence
POST /api/management/connections
PUT /api/management/tenants/:tenant_id/connections/:provider
PUT /api/management/tenants/:tenant_id/defaultsVerified 2026-09-10 by Tyemirov on GitHub against docs/tenant-connections.md.
FAQ
How does first-run LLM Proxy setup begin?
After authentication, the dashboard opens with the selected tenant. The user can connect providers and create a tenant API key.
Can tenant setup continue later?
Yes. The dashboard remains available when the tenant has no API key or provider connections.
Where does a user enter a provider key?
Select Create connection, name the connection, choose its provider, and enter the required fields.
Does onboarding change provider or model defaults?
Creating an API key or connecting a provider preserves existing defaults. Saving a model default requires a separate action.
What should I read next?
A closely related resource is Bring-your-own provider key portal for AI access, which covers bring your own provider key portal.
Related resources
Use this pattern in LLM Proxy
Start from the canonical API reference, then use the management surface when the workflow needs tenant or provider configuration.
Open API reference