---
title: "Find LLM Provider's ApiKeys"
method: GET
path: "/v1/private/llm-provider-key"
tags: ["LlmProviderKey"]
---

# Find LLM Provider's ApiKeys

`GET /v1/private/llm-provider-key`

Find LLM Provider's ApiKeys

## Response `200`

LLMProviderApiKey resource

- ProviderApiKeyPagePublic
  - `size` integer
  - `total` integer
  - `content` ProviderApiKeyPublic[]
    - `id` string, uuid
    - `provider` 'openai' | 'anthropic' | 'gemini' | 'openrouter' | 'vertex-ai' | 'bedrock' | 'ollama' | 'custom-llm' | 'opik-free', required
    - `api_key` string
    - `name` string
    - `provider_name` string — Provider name - required for custom LLM and Bedrock providers to uniquely identify them (e.g., 'ollama', 'vllm', 'Bedrock us-east-1'). Must not be blank for custom and Bedrock providers. Should not be set for standard providers (OpenAI, Anthropic, etc.). This requirement is conditional and validation is enforced programmatically.
    - `headers` object
    - `configuration` object
    - `base_url` string
    - `auth_config` ProviderAuthConfigPublic — Dynamic token auth recipe. When set, Opik fetches a short-lived bearer from the configured auth service instead of using a static api_key. Only supported for custom providers. Secret credential values read back masked.
      - `token_url` string — Auth service URL the credentials are sent to
      - `send_as` 'form' | 'json' | 'basic' — How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body)
      - `credentials` CredentialPublic[] — Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
        - `key` string, required
        - `value` string
        - `secret` boolean — Secret values are encrypted at rest and never read back; once true it cannot be unset
      - `token_field` string — Field holding the token in the reply; dot-path for nested replies
      - `expires_field` string — Field holding the token lifetime in seconds in the reply; dot-path for nested replies
      - `fallback_ttl_seconds` integer — Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins
    - `created_at` string, date-time
    - `created_by` string
    - `last_updated_at` string, date-time
    - `last_updated_by` string
    - `read_only` boolean — If true, this provider is system-managed and cannot be edited or deleted
  - `sortableBy` string[]

## Changes

- **2026-08-26** `0739fa5022ca` — 1 info
  - added the optional property `content/items/auth_config` to the response with the `200` status

[Change history](https://skmtc.dev/comet-ml/apis/opik-rest-api/changes/v1/private/llm-provider-key/get.md)

---

[API](https://skmtc.dev/comet-ml/apis/opik-rest-api.md) · [All operations](https://skmtc.dev/comet-ml/apis/opik-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/comet-ml/opik-rest-api/revisions/a835604ec403/schema)