Authentication

VaultProxy uses two types of API keys: VaultProxy API keys for authenticating your requests, and Provider keys for accessing upstream AI providers.

VaultProxy API Keys

Your VaultProxy API key authenticates every request to the VaultProxy API. Keys follow the format:

vpx_live_xxxxxxxxxxxxxxxxxxxxxxxx
vpx_test_xxxxxxxxxxxxxxxxxxxxxxxx

• vpx_live_ -- Production keys with full access
• vpx_test_ -- Test keys for development (rate-limited, may use mock responses)

Creating Keys

Create API keys through the dashboard at Settings > API Keys, or programmatically:

curl -X POST https://api.vaultproxy.ai/v1/keys \
  -H "Authorization: Bearer vpx_live_YOUR_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Backend",
    "permissions": ["chat:write", "usage:read"]
  }'

Listing Keys

curl https://api.vaultproxy.ai/v1/keys \
  -H "Authorization: Bearer vpx_live_YOUR_API_KEY"

Revoking Keys

curl -X DELETE https://api.vaultproxy.ai/v1/keys/key_id_here \
  -H "Authorization: Bearer vpx_live_YOUR_API_KEY"

warning

Revoked keys are invalidated immediately. Any requests using a revoked key will receive a 401 Unauthorized response.

Using Your Key

Include your VaultProxy API key in the Authorization header with every request:

Authorization: Bearer vpx_live_YOUR_API_KEY

Provider Keys

Provider keys are your existing API keys for upstream AI providers (OpenAI, Anthropic, Google, etc.). VaultProxy stores these securely and uses them to forward your requests.

Adding a Provider Key

curl -X POST https://api.vaultproxy.ai/v1/provider-keys \
  -H "Authorization: Bearer vpx_live_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "openai",
    "api_key": "sk-proj-xxxxxxxxxxxxxxxx",
    "name": "OpenAI Production"
  }'

Supported providers: openai, anthropic, google, mistral, groq, deepseek, cohere, xai, perplexity, bielik.

Listing Provider Keys

curl https://api.vaultproxy.ai/v1/provider-keys \
  -H "Authorization: Bearer vpx_live_YOUR_API_KEY"

info

Provider keys are never returned in full. The API response shows only the last 4 characters (e.g., sk-...x7fQ) for identification purposes.

Removing a Provider Key

curl -X DELETE https://api.vaultproxy.ai/v1/provider-keys/pk_id_here \
  -H "Authorization: Bearer vpx_live_YOUR_API_KEY"

Security

• AES-256 encryption -- All provider keys are encrypted at rest using AES-256-GCM. Encryption keys are managed via a separate key management service.
• No plain-text storage -- Provider keys are never stored in plain text in the database.
• Minimal access -- Provider keys are decrypted only in memory at the moment a request is forwarded to the upstream provider, then immediately discarded.
• Audit trail -- All key creation, usage, and deletion events are logged for compliance.

Rate Limits

Plan	Requests/min	Requests/day
Free	10	500
Pro	120	50,000
Enterprise	Custom	Custom

Rate limit headers are included in every response:

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 119
X-RateLimit-Reset: 1700000000