Scoped API keys. Zero credential leakage.
Mint cryptographic sk-nrouter-* keys with granular budgets, per-key rate limits, customer model ACLs, and caller metadata tags. SHA-256 hashed at rest, instant kill-switch, and zero financial overrun.
Enterprise Key Governance
- Financial overrun risk
- $0.00
- Storage format
- SHA-256
- Revocation latency
- < 10 ms
- Governance scopes
- Org · Team · Key
Atomic preflight budget enforcement
Zero plaintext key storage in database
Global in-memory cache eviction
Hierarchical limits with metadata tags
Sub-millisecond verification without database bottlenecks
Incoming requests present an sk-nrouter-* key. The Rust gateway checks an in-memory SHA-256 hash index, validates rate-limiting slots and budgets, and forwards with vault-held provider credentials.
Virtual Key Preflight & Dispatch Chain
Client Request
Bearer sk-nrouter-...
Client presents virtual key in standard Authorization header. No provider tokens exposed.
Hash Verification
SHA-256 in memory
Rust gateway checks the in-memory hash index in <1ms without hitting the primary database.
Preflight Enforcement
ACL, RPM/TPM & Budget
Verifies model access permission, rate-limit slot, and reserves credits before upstream egress.
Provider Dispatch
Vault Keys Injected
Gateway securely attaches vault-held upstream credentials for the destination LLM provider.
Fine-grained controls for engineering and security teams
Isolation Guarantee
Contain blast radius across projects, teams, and agents
Never share raw provider master keys again. Provision independent virtual keys for production microservices, developer sandboxes, automated evaluations, and autonomous AI agents.
- Per-key daily and monthly spend limits with automatic 402 refusal
- Model allowlists ensure staging keys cannot trigger costly flagship models
- RPM and TPM rate limiting prevents noisy-neighbor cluster degradation
- Audit logging binds every inference call to the originating virtual key ID
Live Tenant Key Fleet
Full virtual key specification — hashing, rate limits, ACLs & metadata
- Zero provider token exposure
- Developers, CI/CD pipelines, and autonomous AI agents only receive sk-nrouter-* virtual keys. Upstream provider keys (OpenAI, Anthropic, AWS, Azure, Google Cloud) remain sealed inside cloud key vaults with zero outbound egress.
- Per-key spend ceilings ($/day, $/month)
- Set hard spending limits at the virtual key level. If a key hits its budget, requests return HTTP 402 Payment Required instantly before hitting model providers. Unused reservations are released immediately with zero financial overrun.
- Model Access Control Lists (ACLs)
- Restrict individual keys or teams to authorized model families. Disallow expensive reasoning models for simple staging tasks or enforce compliance-cleared models for sensitive healthcare/legal workloads.
- RPM & TPM rate-limiting slots
- Prevent rogue loops or noisy-neighbor workloads from overwhelming your tier limits. Virtual keys enforce strict requests-per-minute (RPM) and tokens-per-minute (TPM) ceilings with HTTP 429 Retry-After headers.
- Dual-axis RBAC & metadata tagging
- Every virtual key carries structured metadata tags (persona, team, environment, project ID). Spend and telemetry logs ingest these tags directly into FOCUS 1.4 cost allocation and audit dashboards.
- Cryptographic SHA-256 hashing & instant revocation
- Plaintext virtual keys are shown once at creation and never stored. Keys are verified via high-speed SHA-256 hash lookup. Operators can disable or revoke compromised keys with a single click in <10ms.
Frequently asked questions about virtual keys
How do virtual keys protect against provider key leaks?
With nRouter, developers never touch raw provider API keys from OpenAI, Anthropic, AWS Bedrock, or Google Vertex. Your team receives scoped sk-nrouter-* keys. Upstream credentials remain sealed inside Azure Key Vault or AWS Secrets Manager. If a virtual key is accidentally committed to GitHub, you revoke it instantly without rotating production provider master keys.
Can I restrict a virtual key to specific models or providers?
Yes. Each virtual key can specify an explicit model allowlist or denylist. For example, a customer support bot key can be locked to cost-effective models like google/gemini-2.5-flash and openai/gpt-4o-mini, while deep research keys can access anthropic/claude-3-5-sonnet.
What happens when a virtual key hits its spend limit or rate limit?
When a key exceeds its spend ceiling, nRouter returns HTTP 402 Payment Required cleanly during Preflight Phase 1, before any provider request is dispatched or credit is consumed. When an RPM or TPM ceiling is exceeded, nRouter returns HTTP 429 with standard Retry-After headers.
How fast is virtual key revocation?
Revocation takes effect in under 10 milliseconds across our global edge data plane. The Rust gateway invalidates the in-memory token cache immediately upon receiving the revocation event.
Are virtual keys stored in plaintext in the database?
No. Virtual keys follow strict industry security best practices: the secret portion is hashed with SHA-256 and only the hash is stored in the database. The plaintext token is revealed to the user exactly once at minting time.
Can I attach custom metadata to keys for billing allocation?
Yes. You can attach arbitrary key-value metadata tags (such as environment:production, service:recommendation, cost-center:fintech) to any key. These tags are bound to every spend log row for automated chargeback reporting.
Zero Overrun Guarantee
Secure your model traffic with scoped virtual keys
Create your first virtual key in seconds. Enforce budgets, configure model ACLs, and route to 160+ models with one unified endpoint.