Update Provider Credential
Use /app/form/updateProviderCredential to change the activation window of an
existing provider Credential. Open it from Administration >
GenAI Admin > LLM Models > Credentials by choosing the row’s edit action.
The update form does not accept raw secret material. For an actual rotation, create a new credential record with an incremented version. Editing the binding, version, or reference is intended for correcting a record before activation.
Read-Only Fields
| Field | Example | Description |
|---|---|---|
| Host Id | 01964b05-552a-7c4b-9184-6857e7f3dc5f | Host that owns the Credential. |
| Provider Credential Id | f45ace27-9fa2-46c8-a267-f0824e0dde21 | Stable row identifier generated by Portal. |
| Aggregate Version | 4 | Optimistic-concurrency version. A stale value is rejected. |
active, updateUser, and updateTs are backend-managed and are not submitted.
Editable Fields
| Field | Required | Example | Description |
|---|---|---|---|
| Credential Purpose | Yes | ENDPOINT | Resolver boundary: central Endpoint or sidecar runtime. |
| Provider Endpoint | For ENDPOINT | nvidia-free-embeddings | Endpoint bound to the Credential. |
| Provider Deployment | For SIDECAR_RUNTIME and current compatibility path | nvidia-nemotron-3-embed-1b-loc | Corresponding Deployment. |
| Credential Version | Yes | 2 | Positive version unique within the selected Deployment. Correct it only before activation; create a new version for rotation. |
| Secret Reference | Yes | env:OPENAI_API_KEY_V2 | Environment-variable reference resolved locally by the gateway. Vault or another injector may populate the variable; never enter its value. |
| Effective Time | Yes | 2026-08-15T14:00:00Z | ISO-8601 time when this version becomes eligible. |
| Expiration Time | No | 2026-11-15T14:00:00Z | Optional ISO-8601 cutoff later than Effective Time. |
Use an explicit timezone in both timestamps. Leaving Expiration Time empty keeps the reference effective until it is replaced or deleted.
For NVIDIA, preserve purpose ENDPOINT, Endpoint nvidia-free-embeddings, and
the corresponding Nemotron Deployment. Publish only after the gateway container
can resolve env:NVIDIA_API_KEY. For key rotation, create version 2 with
a new external reference instead of putting a new key value into this form.
Rotation Example
Suppose version 1 is currently used and version 2 should take over at
2026-08-15T14:00:00Z:
- Create version
2with the new external reference and effective time. - Verify the secret and resolver permissions.
- End version
1by setting its Expiration Time to the cutover time. - Publish and test the new snapshot through the target gateway.
Save The Update
Choose Update Provider Credential. The form sends
lightapi.net/genai/updateLlmProviderCredential/0.1.0 with the stable identity,
aggregateVersion, then returns to the LLM Model Control Plane.
Common Problems
- Stale aggregate version: reopen the form from the Credentials tab and apply the change to the latest row.
- Expiration is rejected: ensure it is later than Effective Time and both values contain a timezone.
- Need a different Secret Reference after activation: create the next credential version instead of rewriting operational history.
- Publication still reports no credentialed route: verify Effective Time has arrived, Expiration Time has not passed, and the row was not deleted.
- 403 on Update: confirm access to
lightapi.net/genai/updateLlmProviderCredential/0.1.0and the required write permission.
For the full eligibility and rotation workflow, see the Credentials tab guide.