---
title: "Get LLM Provider's ApiKey by id"
method: GET
path: "/v1/private/llm-provider-key/{id}"
tags: ["LlmProviderKey"]
---

# Get LLM Provider's ApiKey by id

`GET /v1/private/llm-provider-key/{id}`

Get LLM Provider's ApiKey by id

## Path parameters

- `id` string, uuid, required

## Response `200`

LLMProviderApiKey resource

- ProviderApiKeyPublic
  - `id` string, uuid
  - `provider` 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'vertex-ai' | 'bedrock' | 'ollama' | 'custom-llm' | 'opik-free', required
  - `api_key` string
  - `name` string
  - `provider_name` string — Provider name - required for custom LLM and Bedrock providers to uniquely identify them (e.g., 'ollama', 'vllm', 'Bedrock us-east-1'). Must not be blank for custom and Bedrock providers. Should not be set for standard providers (OpenAI, Anthropic, etc.). This requirement is conditional and validation is enforced programmatically.
  - `headers` object
  - `configuration` object
  - `base_url` string
  - `auth_config` ProviderAuthConfigPublic — Dynamic token auth recipe. When set, Opik fetches a short-lived bearer from the configured auth service instead of using a static api_key. Only supported for custom providers. Secret credential values read back masked.
    - `token_url` string — Auth service URL the credentials are sent to
    - `send_as` 'form' | 'json' | 'basic' — How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body)
    - `credentials` CredentialPublic[] — Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
      - `key` string, required
      - `value` string
      - `secret` boolean — Secret values are encrypted at rest and never read back; once true it cannot be unset
    - `token_field` string — Field holding the token in the reply; dot-path for nested replies
    - `expires_field` string — Field holding the token lifetime in seconds in the reply; dot-path for nested replies
    - `fallback_ttl_seconds` integer — Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins
  - `created_at` string, date-time
  - `created_by` string
  - `last_updated_at` string, date-time
  - `last_updated_by` string
  - `read_only` boolean — If true, this provider is system-managed and cannot be edited or deleted

## Other responses

- `404` — Not found

## Changes

- **2026-08-26** `0739fa5022ca` — 1 info
  - added the optional property `auth_config` to the response with the `200` status

[Change history](https://skmtc.dev/comet-ml/apis/opik-rest-api/changes/v1/private/llm-provider-key/:id/get.md)

---

[API](https://skmtc.dev/comet-ml/apis/opik-rest-api.md) · [All operations](https://skmtc.dev/comet-ml/apis/opik-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/comet-ml/opik-rest-api/revisions/a835604ec403/schema)