LiteLLM keys

The LiteLLM keys screen lets you create the LiteLLM virtual keys of an LLM project, limit them, block them and revoke them, and follow their spend and expiry. A key is never wider than its project and its clear value is shown only once. Portal path: /llm/keys (or /llm/keys?project=<id> from the LLM projects screen). It is used by the tenant and platform administrators (tenant_admin, platform_admin). The screen is built in portal/src/screens/llm-management.tsx (LlmKeys, ProjectKeys, CreateKeyDialog, KeyLimitsDialog).

What the screen shows

• The section LiteLLM admin API (GET /v1/llm/management/status), with the same three states as on LLM projects and Check again.
• The selector Project, filled from GET /v1/llm/projects; a project that is not active shows its status in brackets. Without project: "No LLM project yet. Create an LLM project first in the LLM projects page."
• The section Keys of <project> with the reminder "Project limits: budget <budget>, <rpm> RPM, <tpm> TPM. A key can only be tighter." and the button New key.
• When LiteLLM could not refresh the spend: "Spend not refreshed from LiteLLM (<code>): last known values shown."
• The table of the keys (GET /v1/llm/projects/{project_id}/keys):

Column	Content
Key	<name> (<alias>), or the alias alone.
Prefix	First characters of the key followed by ...; the clear key is never stored.
Status	active, blocked or revoked.
Models	Models of the key, or Project models.
Max budget	Budget of the key, or Project (<value>) when it inherits the project budget.
Spend	Spend read from LiteLLM, in the project currency.
Rate limits	<n> RPM, <n> TPM, <n> parallel, - when inherited.
Expires	Expiry date, empty when the key does not expire.

When the project has no key: "No key for this project. Create a key: its clear value is shown only once."

The creation form ("Limits are pre-filled from the project <name>; a blank limit inherits the project limit.") has Key name, Key alias (blank: generated from the tenant and the project), Models (subset of the project models; blank: every model of the project), Max budget, Budget period, Requests per minute (RPM), Tokens per minute (TPM), Max parallel requests and Expires after (days) (blank: the key does not expire). Before sending, the portal checks that no limit is wider than the project and that every model is allowed by the project; the Control Plane checks it again.

Actions

Button or action	What it does	API call	Roles
Check again	Probes the LiteLLM admin API again.	GET /v1/llm/management/status	tenant_admin, platform_admin
Project selector	Shows the keys of the chosen project.	GET /v1/llm/projects/{project_id}, GET /v1/llm/projects/{project_id}/keys	tenant_admin, platform_admin
New key (section or empty state)	Generates the key in LiteLLM. The dialog Key created shows the clear key once with a copy button and the warning "This key is shown only once"; I copied the key closes it and drops the value from memory. Greyed when the project is not active.	POST /v1/llm/projects/{project_id}/keys	tenant_admin, platform_admin
Change the limits (row menu)	Dialog Limits of <alias>: name, models and limits (alias and expiry are fixed at creation). Toast Limits saved.	PATCH /v1/llm/projects/{project_id}/keys/{key_id}	tenant_admin, platform_admin
Block (row menu, active key)	Blocks the key at once. Toast Key blocked.	POST /v1/llm/projects/{project_id}/keys/{key_id}/block	tenant_admin, platform_admin
Unblock (row menu, blocked key)	Allows the key again. Toast Key unblocked.	POST /v1/llm/projects/{project_id}/keys/{key_id}/unblock	tenant_admin, platform_admin
Revoke (row menu)	Destructive confirmation with the risk "Applications using this key lose access at once; a revoked key cannot be restored."; type the resource name, then Confirm. Toast Key revoked.	DELETE /v1/llm/projects/{project_id}/keys/{key_id}	tenant_admin, platform_admin

A revoked key has no row menu: it cannot be changed anymore.

Roles

• Every route of the screen requires ADMIN of services/control-plane/src/eai/domains/llm_management/__init__.py: tenant_admin or platform_admin (MANAGERS in portal/src/lib/llm-management.ts). Other roles get forbidden.
• New key and the row menus are shown only to these roles.
• A principal without tenant gets tenant_required.

Typical tasks

Give a key to an application

1. Choose the project. Select it in Project, because the key inherits its models and limits. Expected result: the section Keys of <project> with the project limits. If it fails: "The project is not active: no key can be created." means the project is suspended or archived; reactivate it in LLM projects.
2. Fill the key. Click New key, type a Key name, narrow Models if the application needs fewer models, and set Expires after (days), so that the key expires on its own. Expected result: no red message under the form. If it fails: a red line says which limit is wider than the project or which model is not allowed; lower the value.
3. Create and copy. Click New key, then copy the value shown in Key created into your secret store. Expected result: the clear key and the warning "This key is shown only once". If it fails: "LiteLLM is not configured" (503) means no key can be generated; configure LiteLLM first.
4. Close. Click I copied the key. Expected result: the dialog closes and the table shows the new key with its Prefix. If it fails: if you lost the value, revoke the key and create a new one; it cannot be displayed again.

Stop a leaked key

1. Block it. Row menu > Block, so that every call with this key is refused at once while you investigate. Expected result: toast Key blocked, Status blocked. If it fails: "This key is revoked: it cannot be changed anymore."
2. Revoke it. When the leak is confirmed, row menu > Revoke, type the resource name, then Confirm. Expected result: toast Key revoked, Status revoked. If it fails: the message of the API is shown under the confirmation.
3. Replace it. Create a new key for the application (first task). Expected result: the application works with the new key. If it fails: check its models and limits.

Troubleshooting

Symptom	Cause	Fix
Red line "<field> (<value>) is wider than the project limit (<limit>)." or 422 llm_key_limit_exceeds_project	A key limit is above the project limit.	Lower the value, or raise the project quota first.
"The model <model> is not allowed by the project." (llm_key_model_not_allowed, 422)	The model is outside the allowed models or categories of the project.	Remove the model, or allow it on the project.
New key greyed, "The project is not active: no key can be created." (llm_project_inactive, 409)	Project suspended or archived.	Set the project status to active.
"This key is revoked: it cannot be changed anymore." (llm_key_revoked, 409)	Revoked keys are final.	Create a new key.
"LiteLLM key not found." (llm_key_not_found, 404)	The key was deleted meanwhile.	Refresh the page.
LiteLLM is not configured (litellm_not_configured, 503) on New key	No LiteLLM admin address or master key.	Set EAI_LITELLM_ADMIN_URL and EAI_LITELLM_MASTER_KEY_REF, then Check again.
"Spend not refreshed from LiteLLM (<code>)"	LiteLLM did not answer the spend request.	The last known spend is shown; check the proxy.
Error panel forbidden (403)	Role other than tenant_admin or platform_admin.	Ask a tenant administrator.

Related pages

• LLM projects
• LiteLLM config
• API keys
• Secrets
• Unified LLM proxy (B-01)
• Configuration reference