Management UI
TAuth-protected management API for LLM Proxy
Gate account, tenant, provider key, defaults, usage, and admin APIs behind validated TAuth sessions.
Teams adopting the MPR/TAuth shell for authenticated AI self-service.
The problem
Key management APIs need a stronger boundary than a public static page. They must know who is signed in and which tenant that user owns.
How LLM Proxy helps
LLM Proxy validates configured TAuth session cookies on /api/management/* and returns unauthenticated or forbidden responses for invalid sessions.
How it works
- Configure TAuth URL, tenant ID, session cookie name, issuer, and signing key.
- Serve browser-facing MPR UI/TAuth config through /config-ui.yaml.
- Require authenticated sessions before returning account, tenant, provider, default, secret, usage, or admin data.
- Use the shared MPR header, user menu, and footer in the static UI.
Feature-to-benefit table
| Feature | Why it matters here | Example |
|---|---|---|
| Session validation | Management APIs validate TAuth session cookies server-side. | Unauthenticated requests return 401. |
| Tenant ownership | Signed-in users manage one or more personal tenants, each with isolated secrets, provider keys, defaults, examples, and usage. | Foreign tenant ids return 404 without disclosure. |
| Admin derivation | Admin status is derived from configured emails and authenticated session data. | Admin APIs return 403 for non-admin users. |
Use-case examples
Account load
The static app calls /api/management/account after TAuth reports authentication, then loads /api/management/tenants/:tenant_id for the selected tenant.
Settings mutation
Provider key saves and secret generation require JSON content and the public origin.
Admin dashboard
A configured admin receives an Admin menu item after profile load.
Objections and limitations
- TAuth tenant and cookie settings must match the deployment profile.
- The public proxy endpoints still use tenant-secret authentication, not TAuth sessions.
- Serve /config-ui.yaml and load mpr-ui-config.js so MPR UI owns every browser authentication request and session transition.
FAQ
What is the main job of TAuth protected management API?
LLM Proxy validates configured TAuth session cookies on /api/management/* and returns unauthenticated or forbidden responses for invalid sessions.
Who should read this management ui resource?
Teams adopting the MPR/TAuth shell for authenticated AI self-service.
Does this page claim provider performance or pricing advantages?
No. The supported claim is about LLM Proxy's documented routing, configuration, management, security, usage, and deployment contracts. Provider cost, speed, rankings, and benchmark claims are not made here.
Where should setup details come from?
Use the main README and implementation notes for current command, config, and endpoint details. This page summarizes the workflow without replacing LLM Proxy documentation.
What should I read next?
A closely related resource is Self-service LLM key management for internal teams, which covers self-service LLM key management.
Related resources
Use this pattern in LLM Proxy
Start from the canonical API reference, then use the management surface when the workflow needs tenant or provider configuration.
Open API reference