Keys: who may call the gateway

A gateway holding provider keys must not answer anyone who finds its address. The master key is the simplest lock; per-team keys with budgets need a database.

litellm --config config.yaml --port 4000 > gateway.log 2>&1 &
until curl -s localhost:4000/health/liveliness > /dev/null; do sleep 1; done
BODY='{"model": "quick", "messages": [{"role": "user", "content": "hi"}]}'
curl -s -o /dev/null -w "%{http_code} no key\n" localhost:4000/chat/completions \
  -H "Content-Type: application/json" -d "$BODY"
curl -s -o /dev/null -w "%{http_code} master key\n" localhost:4000/chat/completions \
  -H "Content-Type: application/json" -H "Authorization: Bearer sk-gateway-1234" -d "$BODY"
kill %1

BODY holds the request once, and -w "%{http_code}" makes curl print only the status code. No key: 401. The master key: 200.

The master key is all-powerful: it can call every model and manage the gateway. Give it to no app. What apps should get are virtual keys: keys the gateway creates, each limited to certain models, with its own budget and spend tracking.

Virtual keys need a database

litellm --config config.yaml --port 4000 > gateway.log 2>&1 &
until curl -s localhost:4000/health/liveliness > /dev/null; do sleep 1; done
curl -s localhost:4000/chat/completions \
  -H "Authorization: Bearer sk-billing-team" \
  -H "Content-Type: application/json" \
  -d '{"model": "quick", "messages": [{"role": "user", "content": "hi"}]}'
echo
kill %1

Any key other than the master key is looked up in the gateway's database, and this gateway has none, so the answer is No connected db. The gateway quickstart adds a PostgreSQL database_url under general_settings for virtual keys, budgets, spend tracking and the admin UI; with it, /key/generate creates keys. Running PostgreSQL is outside this course, and the last lesson names it.