---
title: "Test a provider's dynamic token auth"
method: POST
path: "/v1/private/llm-provider-key/auth-config/test"
tags: ["LlmProviderKey"]
---

# Test a provider's dynamic token auth

`POST /v1/private/llm-provider-key/auth-config/test`

Runs the token fetch once, backend-side, and reports the token lifetime. The token itself is never returned. Send provider_id to test the stored config, auth_config to test submitted values, or both to resolve secret sentinels against the stored config.

## Request body

- ProviderAuthCheck
  - `provider_id` string, uuid — Test the stored auth config of this provider; also the sentinel-resolution target when auth_config is sent
  - `auth_config` ProviderAuthConfig — Dynamic token auth recipe. Send the '__SECRET__' sentinel as a credential value to keep the stored secret; send an empty object to clear the auth config.
    - `token_url` string — Auth service URL the credentials are sent to
    - `send_as` 'form' | 'json' | 'basic' — How credentials are sent: form body (default), JSON body, or basic auth (id/secret in an HTTP Basic header, remaining fields in the form body)
    - `credentials` Credential[] — Fields sent to the token URL. Values flagged as secret are write-only: they read back as the '__SECRET__' sentinel
      - `key` string, required
      - `value` string
      - `secret` boolean — Secret values are encrypted at rest and never read back; once true it cannot be unset
    - `token_field` string — Field holding the token in the reply; dot-path for nested replies
    - `expires_field` string — Field holding the token lifetime in seconds in the reply; dot-path for nested replies
    - `fallback_ttl_seconds` integer — Lifetime in seconds assumed when the reply doesn't state one, capped at one year; 0 disables caching for such replies. A reply-stated lifetime always wins

## Response `200`

Token fetched

- Result
  - `name` string
  - `current` number, double
  - `previous` number, double

## Other responses

- `400` — Bad Request — the token fetch itself failed (unreachable URL, rejected credentials, malformed reply)
- `403` — Access forbidden
- `404` — Not found
- `422` — Unprocessable Content — the request is invalid (neither provider_id nor auth_config, or an invalid auth_config)

## Changes

- **2026-08-26** `0739fa5022ca` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/comet-ml/apis/opik-rest-api/changes/v1/private/llm-provider-key/auth-config/test/post.md)

---

[API](https://skmtc.dev/comet-ml/apis/opik-rest-api.md) · [All operations](https://skmtc.dev/comet-ml/apis/opik-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/comet-ml/apis/opik-rest-api/revisions/4baa2ed0236f?raw)