credenciais

Operations

Stores an LLM API key imported by the local runner

Request

Authenticated by a MACHINE device key (never a session JWT, never a project-bound credential). Same envelope encryption as POST /users/me/credentials. 409 credencial_existente when the user already has this provider and substituir is not true. The key is never logged nor returned.

Security

bearer

Bodyapplication/jsonrequired

providerstringrequired

Enum:"anthropic""openai""openrouter""nvidia-nim""together""deepinfra""bitdeer""vultr""9router""opencode-zen"

Example:"anthropic"

apiKeystring, <= 512 charactersrequired

The API key in plain text. Encrypted before touching the database; NEVER logged and NEVER returned.

origemstring, <= 200 charactersrequired

Tool and path the key was read from. Audit log only; never a value.

Example:"codex: ~/.codex/auth.json"

substituirboolean

Must be true to replace an existing credential of this provider.

POST

/runner/llm-credentials

Payload

{
  "provider": "anthropic",
  "apiKey": "string",
  "origem": "codex: ~/.codex/auth.json",
  "substituir": true
}

Responses

Bodyapplication/json

providerstringrequired

Enum:"anthropic""openai""openrouter""nvidia-nim""together""deepinfra""bitdeer""vultr""9router""opencode-zen"

substituidabooleanrequired

Whether an existing credential was replaced.

Response

{
  "provider": "anthropic",
  "substituida": true
}