AI Gateway1 / 5
Your apps should
never see the
provider AI key.
But the key sits in env, in config, sometimes
in the code. And every rotation is a deploy.
in the code. And every rotation is a deploy.
apinizer.Apps never see the keyAI Gateway2 / 5
A better way:
keep it on the connection.
The real key stays encrypted in the gateway
The app authenticates with its own Apinizer credential
Budgets and quotas scope to credential · organization · proxy · project
apinizer.Apps never see the keyAI Gateway3 / 5
Rotation never
touches the app.
Update the key on the LLM connection
Redeploy the proxy — hot, no pod restart
No application change, no application redeploy
apinizer.Apps never see the keyAI Gateway4 / 5
On top:
separation of duties.
01
AI development · AI trace
Building policies and reading full-content traces, separate
02
AI analytics · AI budgets
Reading spend and setting ceilings, separate rights
03
Privacy by default
Prompt bodies never raw-logged — full-content trace is opt-in and bounded
apinizer.Apps never see the keyAI Gateway5 / 5
Keeping the key in the app
makes it hard to rotate
and easy to leak.
The secret should live at the gateway, not in the app.
How many apps are your
provider keys spread across?
provider keys spread across?
apinizer.Apps never see the key← → to navigate