Credentials

Credentials let your organization use its own model provider keys and optional object storage. Orlo encrypts the secret and returns metadata when you list credentials. See Provider key security for the protection, server-side use, and revocation boundaries.

Console users manage keys under Settings → Keys. API callers need credentials.read to list keys, or credentials.write to create, rename, test, or deactivate them. Keep these scopes off keys used only for task inference.

Endpoints

Method	Path	Result
`POST`	`/v1/credentials`	Store a credential; return `id`, `provider`, `label`, and the supplied `base_url`
`GET`	`/v1/credentials`	Return a `credentials` array of metadata, including `last_check`; no secret values
`PATCH`	`/v1/credentials/:id`	Rename a credential with `{ "label": "Production" }`; return its metadata in `credential`
`POST`	`/v1/credentials/:id/test`	Record provider access; return `id`, `status`, `message`, `model_count`, and up to 50 model names
`DELETE`	`/v1/credentials/:id`	Deactivate the credential; return `204` with no body

A successful key check confirms the provider accepted the check. It does not guarantee inference quota or success for every model. See model availability states.

Store a provider key

Field	Type	Meaning
`provider`	string	`openai`, `anthropic`, `vllm`, `llama_cpp`, `cloudflare`, `huggingface`, `custom`, or `object_storage`
`label`	string	A name your team can recognize; do not include the key
`api_key`	string	Provider secret; may be empty for a vLLM or llama.cpp endpoint that does not require authentication
`base_url`	string, optional	Provider endpoint. For Cloudflare, use the account ID. For object storage, use the JSON configuration below

Use HTTPS for provider URLs. Custom addresses must be public unless your deployment explicitly permits private addresses.

bash

curl https://api.useorlo.com/v1/credentials \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $ORLO_API_KEY" \
  -d '{
    "provider": "openai",
    "label": "Production",
    "api_key": "<your-provider-key>"
  }'

Response (201):

json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "provider": "openai",
  "label": "Production"
}

The newest active key for a provider is used for new lookups. To rotate, add and test the replacement, then deactivate the old key. Deactivation does not revoke the token at the provider. See Replace or revoke a key.

Object storage credentials

For provider = "object_storage", put the secret access key in api_key. Set base_url to a JSON string with bucket and accessKey. Optional fields include region, endpoint, and pathPrefix.

json

{
  "provider": "object_storage",
  "label": "Organization documents",
  "api_key": "<secret-access-key>",
  "base_url": "{\"bucket\":\"org-docs\",\"accessKey\":\"<access-key-id>\",\"region\":\"us-east-1\"}"
}

The OpenAPI reference includes the request and response fields and examples.