Create Provider Credential

Use /app/form/createProviderCredential to associate a Provider Endpoint or sidecar runtime with a versioned external secret reference. Open the form from Administration > GenAI Admin > LLM Models > Credentials by choosing Create provider credential.

Portal stores only the reference. Create the actual credential in the target environment’s supported secret manager before activating this record.

Before You Begin

You need:

• a non-deleted Provider Endpoint and corresponding Deployment for an ENDPOINT credential, or a Deployment for SIDECAR_RUNTIME;
• an external secret-manager entry containing the provider credential;
• the URI syntax supported by the gateway’s configured secret resolver; and
• an activation and optional expiration time for this version.

Do not paste the provider API key, token, password, JSON credential document, or authorization header into any field.

Form Fields

Portal generates providerCredentialId and initializes aggregateVersion. The form does not accept active; soft-delete state is backend-managed.

Purpose and owner

For ENDPOINT, select the Provider Endpoint and its corresponding Deployment. For SIDECAR_RUNTIME, select the Deployment and do not select an unrelated Endpoint. All references must be non-deleted and owned by the selected host.

Credential Version

Versions are unique per Deployment. A typical sequence is:

Create a new version for rotation. Do not reuse a version number or overwrite an older version to represent different secret material.

Secret Reference

For instance-property delivery, use the environment-variable name available to the gateway process:

env:OPENAI_API_KEY
env:AZURE_OPENAI_API_KEY
env:NVIDIA_API_KEY

Kubernetes, Docker, or HashiCorp Vault injection may populate that environment variable; Portal neither reads nor stores its value. Absolute external URIs such as vault://... remain valid control-plane references only when the target gateway is configured with a resolver that maps that exact reference. The default instance-property path resolves env:VARIABLE_NAME directly. Portal does not prove that the variable exists, so provision and test it on the target gateway before activation.

Values such as sk-live-..., Bearer ..., raw JSON, passwords, and copied API keys are forbidden. They can leak through events, logs, audit records, and UI history even if entered accidentally.

Effective And Expiration Times

Use ISO-8601 timestamps with a timezone, preferably UTC with Z:

Effective Time:  2026-08-15T14:00:00Z
Expiration Time: 2026-11-15T14:00:00Z

Publication eligibility uses the database clock. Before effectiveTs, the row is not eligible. At or after expiresTs, it is no longer eligible. An empty expiration means the time window does not expire automatically.

Activation window

Portal publishes the reference only while this time window is effective. Portal never resolves or tests the referenced secret.

After creation:

1. Confirm the external secret exists in the target environment.
2. Confirm the gateway’s workload identity can resolve it.
3. Verify the activation window.
4. Publish and test the configuration through the target gateway.

Submit The Credential

Choose Create Provider Credential. The form sends lightapi.net/genai/createLlmProviderCredential/0.1.0 and returns to the LLM Model Control Plane after success.

NVIDIA Endpoint credential

For the hosted Nemotron Endpoint, use:

Pass NVIDIA_API_KEY into the light-gateway process through runtime secret injection or Compose environment expansion. Never commit its value to Portal configuration. Publish only after the target gateway can resolve the variable.

Common Problems

• Deployment list is empty: confirm the Deployment exists, is not deleted, and belongs to the selected host.
• Secret Reference is rejected: enter env:VARIABLE_NAME (for example, env:OPENAI_API_KEY) or a URI supported by an explicitly configured resolver, not a raw credential.
• Credential version already exists: increment the version for that Deployment.
• Expiration is rejected: make it later than Effective Time and include a timezone.
• Publication still fails: verify the Effective Time has arrived and the Expiration Time has not passed.
• 403 on Create: confirm access to lightapi.net/genai/createLlmProviderCredential/0.1.0 and the required write permission.

For the full eligibility and rotation workflow, see the Credentials tab guide.