Virtual Keys: No More Sharing Provider API Keys

Give your teams access to AI providers without handing over the keys

Every app or script that called an AI provider — OpenAI, Anthropic, Gemini, or any provider AI Gateway connects to required its own provider key. That placed credentials on every laptop, container, and continuous integration job that handled requests. Virtual Keys fix this. Administrators register each provider’s key once, then map it to a token or user group. Client apps see only a token; AI Gateway injects the real key when sending the request.

Key Capabilities	Description
Centralize provider credentials	Register the key for any AI provider AI Gateway uses once. Do not expose keys to client code, scripts, or containers.
Map keys by group	Assign a Virtual Key to a token group or a user group as a fallback. AI Gateway selects the correct credential for each request.
Rotate without client changes	Update or rotate a key in one place. No redeploys or client changes.

Path Mapping: Any Client Path, Fully Supported

No more waiting on a release because a client calls a different path

AI Gateway matches each request’s path against a fixed list of known provider paths. Requests outside that list, whether from a legacy agent, a customer proxy, or a provider variant, receive no inspection, policy enforcement, or logging. Path Mapping fixes this. Administrators map any custom path to a canonical API path in the AI Gateway console. That traffic is then governed without waiting for an AI Gateway release.

Key Capabilities	Description
Handle parametrized paths	Use one wildcard (`*`) to cover paths that embed model names or IDs — one row instead of one per model.
Rewrite upstream paths (optional)	Set a `target_path` when the upstream provider accepts only the canonical path. AI Gateway rewrites the path in flight.
Get full policy coverage	Mapped traffic gets the same DLP, AI guardrails, activity, and access logging as any natively supported API.

Note: Existing provider paths continue to work as it did earlier.

MCP Spec Support (2026-07-28)

AI Gateway now supports the latest MCP spec, without breaking older clients

AI Gateway supports the MCP specification (2026-07-28), including the stateless protocol core and updated authorization model, while remaining compatible with clients on the 2025-11-25 spec. Policy enforcement, rate limiting, and content inspection continue to work the same.

AI Gateway Release Notes Version - 1.9

AI Gateway 1.9 locks provider keys away and supports the paths legacy clients already use.