AI Gateway1 / 5
Your apps should
never see the
provider AI key.
But the key sits in env, in config, sometimes
in the code. And every rotation is a deploy.
in the code. And every rotation is a deploy.
apinizer.Apps never see the keyAI Gateway2 / 5
A better way:
virtual keys.
The real key stays encrypted in the gateway
The app uses a virtual identity the gateway issues
Mapping: per user · role · project · team
apinizer.Apps never see the keyAI Gateway3 / 5
Rotation is no longer
a deploy.
Define the new key
Give the old one a grace period
Priority shifts to the new key — no code change
apinizer.Apps never see the keyAI Gateway4 / 5
On top:
separation of duties.
01
ai-admin · ai-developer
Admin and development, separate
02
ai-analytics · ai-finance
Analytics and budget, separate rights
03
Privacy by default
Prompts never raw-logged — HMAC-SHA256 hash
apinizer.Apps never see the keyAI Gateway5 / 5
Keeping the key in the app
makes it hard to rotate
and easy to leak.
The secret should live at the gateway, not in the app.
How many apps are your
provider keys spread across?
provider keys spread across?
apinizer.Apps never see the key← → to navigate