Skip to main content

​
Overview

Store your LLM API keys in OneCLI and the gateway injects them into requests automatically. Agents call model APIs without ever seeing the raw key.
LLMs tab in the OneCLI Connections dashboard

​
What you will set up

  • An LLM key for each provider you use, stored encrypted in OneCLI
  • Automatic injection into the right header for each provider host
  • Per-agent access to each key, with optional rules

​
How it works

  1. You add an API key in the OneCLI dashboard under Connections > LLMs
  2. OneCLI encrypts and stores the key (AES-256-GCM at rest)
  3. When an agent sends a request to a matching host (e.g. api.anthropic.com), the gateway injects the key into the appropriate header
  4. The request is forwarded to the provider
If you rotate a key, update it in the dashboard and all agents pick up the new key automatically.

​
Controlling access

Access is per agent: attach the key to each agent that needs it — an agent without the grant can’t use it at all. Organization rules add guardrails on top: rate-limit requests, restrict agents to specific models by blocking certain paths, or flag high-cost operations for manual approval. Everything is checked before credential injection, so a blocked request never reaches the provider.

​
FAQ

Create a new key with the provider, then update it in the OneCLI dashboard. All agents pick up the new key automatically.
Store them in OneCLI instead of OPENAI_API_KEY or ANTHROPIC_API_KEY. The gateway injects the key at the proxy, so the agent never holds it. See How it works.
Yes. Anthropic accepts a token from claude setup-token, and OpenAI accepts Codex OAuth credentials. See Anthropic and OpenAI.
Follow the quickstart, then add a key under Connections > LLMs and attach it to an agent.