AI keys

The AI Gateway uses two kinds of key. Provider keys are your own OpenAI and Anthropic keys, which the gateway uses to call the provider, and gateway keys are what your code sends to the gateway. Both live under AI Gateway, then Keys.

Add your own OpenAI or Anthropic key

Under Provider keys, choose Add key next to OpenAI or Anthropic, paste the key and choose Save key. OpenAI keys start with sk- and Anthropic keys with sk-ant-, and because an Anthropic key also starts with sk-, Dekka refuses one saved as an OpenAI key. A key with the wrong prefix answers 422 invalid_provider_key.

Only admins and owners can add or remove provider keys, and only while signed in to the dashboard, so an API key can't. Dekka encrypts the key and shows only its last four characters again. Each provider has one key at a time, so saving a new one replaces the old one straight away, and Remove stops Dekka using it.

What if I don't add a key?

Requests to a provider without a key of your own use Dekka's key for that provider where there is one, and otherwise answer 503 provider_unavailable. With your own key, the provider bills your account for the tokens. Either way, every answered request counts its tokens against your plan's AI token allowance.

Create a gateway key

Under Gateway keys, choose Create gateway key, give it a name such as local-development, choose the Project its requests belong to, or Every project, and choose Create key. Dekka shows the key, which starts with dk_, once and stores only a hash, so copy it before you close the dialog.

A gateway key has the single scope ai, which reaches the gateway under /v1/ai and answers 404 on every other route, so it can't manage your organisation. Only admins and owners can create one, from the dashboard. It doesn't expire, so revoke it with the bin icon next to it when you stop using it.

The gateway answers 401 invalid_api_key for a key that is wrong, expired or revoked, and 403 ai_scope_required for an API key without the ai scope.

Choose a project for each request

A key tied to a project logs every request against that project and follows its routing rules. A key for every project logs its requests without a project, with no routing rules or spend cap, unless the request names a project in the X-Dekka-Project header. The project ID is in the dashboard's address after /projects/.

const client = new OpenAI({
  baseURL: "https://api.dekka.cloud/v1/ai",
  apiKey: process.env.DEKKA_AI_KEY,
  defaultHeaders: { "X-Dekka-Project": process.env.DEKKA_PROJECT_ID },
});

The project must belong to your organisation, and a key tied to one project can only name that project. Anything else answers 404 project_not_found.

Connect a service on the canvas

A service on Dekka can get its own gateway key without you creating one. On the project's canvas, choose Add, then AI Gateway, and choose Add AI Gateway. Then drag from the right edge of your service to the AI Gateway node.

Dekka creates a gateway key for that connection, tied to the project, sets DEKKA_AI_BASE_URL and DEKKA_AI_KEY on the service and restarts it. The line turns solid once the restart succeeds, and a stopped service picks the variables up when it next starts.

import OpenAI from "openai";

export const ai = new OpenAI({
  baseURL: process.env.DEKKA_AI_BASE_URL,
  apiKey: process.env.DEKKA_AI_KEY,
});

These keys don't appear under Gateway keys. Removing the connection, the service or the environment revokes the key.