Core Concepts

Gateway Keys & Vault

Agents hold a Spineforge gateway key. Your real provider keys stay in the Vault. That separation is what makes control possible.

Two kinds of credentials

Gateway keyProvider key
Looks likesfgw-xxxx-xxxxYour OpenAI / Anthropic / Gemini / Groq key
Held byAgents, IDEs, CLIs, developersThe Spineforge Vault only
Created inDashboard → API KeysDashboard → Vault
If leakedRevoke instantly, nothing else is affectedNever exposed to agents or client-side code

The Vault

Your master LLM API keys are encrypted and stored in an isolated key vault. At request time the gateway resolves the right provider key for the model being called and injects it into the upstream request. The key is never returned to the agent, so it never ends up in local environments, IDE settings or client-side code.

Gateway keys

Create gateway keys in the dashboard's API Keys tab. Each key represents one agent (or developer, or environment) and carries its own policy:

  • Scopes: which providers and models the key can reach (details).
  • Budget cap: a USD limit, per day or per month.
  • Rate limit: requests per minute (RPM).
  • Status: active or revoked.
Recommendation: use one key per agent and per environment. Per-key policy and per-key attribution only mean something if keys aren't shared.

Revocation: the kill-switch

Because every request flows through the gateway, revoking a key takes effect immediately. The key's status is set to revoked and all in-flight and future proxy requests are blocked with 403 Forbidden. The agent can't keep working from a cached credential, because it never had a provider credential in the first place.

Credential custody: migrate your keys

Custody only works if raw provider keys exist exclusively in the Spineforge Vault. If a key also lives in an env file, a CI variable or a shared secret store, any process that can read it can call the provider directly, registered or not. Once your agents are on gateway keys, remove raw provider keys from those other locations. It is the step that makes the security guarantee hold.

Rotating keys

  • Gateway key: create a new key, update the agent, then revoke the old one.
  • Provider key: replace it in the Vault and in the provider's dashboard. Agents don't need to change because they never held it.

Next steps