# Model keys

4 calls. Every request needs the `Authorization` header: see [the overview](https://docs.maitento.com/reference.md).

## `modelKeys.list`

```http
GET /tenants/self/model-keys
```

Every model key of the tenant (the secrets are never served; `keyHint` shows the last four characters).

**Who can call it:** Admins and members, with an API key or a portal session. [Try it in the API playground](https://docs.maitento.com/playground/?call=GET%20%2Ftenants%2Fself%2Fmodel-keys).

**Response:** [`TenantModelKey`](https://docs.maitento.com/reference/types/tenant-model-key.md)`[]` (200)

```bash title="curl"
curl -X GET "https://api.maitento.com/tenants/self/model-keys" \
  -H "Authorization: $MAITENTO_AUTH"
```
```ts title="TypeScript"
const keys = await mt.modelKeys.list();
```
```python title="Python"
mt.model_keys.list()
```

## `modelKeys.create`

```http
POST /tenants/self/model-keys
```

Stores a provider key.

**Who can call it:** Tenant admins only, with an API key or a portal session. [Try it in the API playground](https://docs.maitento.com/playground/?call=POST%20%2Ftenants%2Fself%2Fmodel-keys).

**Request body:** [`TenantModelKeyCreateRequest`](https://docs.maitento.com/reference/types/tenant-model-key-create-request.md)

| Field | Type | Required | Description |
|---|---|---|---|
| `provider` | `string \| null` |  | The vendor: `Anthropic`, `OpenAi`, `DeepSeek`, `Gemini`, `Qwen`, `Glm` or `Kimi` (case-insensitive). Any other name is refused with `api:model-keys:provider-invalid`. |
| `label` | `string \| null` |  | A name for the key, 1–100 characters. |
| `apiKey` | `string \| null` |  | The provider API key. Write-only: it is never served back (only its last four characters). |
| `baseUrl` | `string \| null` |  | Optional endpoint to call instead of the provider's default: an absolute https URL to a public host. |
| `modelNameOverrides` | `map<string, string> \| null` |  | Optional map from a model's id at the provider to the name the endpoint serves it under, typically Azure OpenAI deployment names. |
| `priority` | `integer \| null` |  | Failover order among the tenant's keys for this provider, lower first (0–1000). Omitted: after the existing keys. |

**Response:** [`TenantModelKey`](https://docs.maitento.com/reference/types/tenant-model-key.md) (200)

```bash title="curl"
curl -X POST "https://api.maitento.com/tenants/self/model-keys" \
  -H "Authorization: $MAITENTO_AUTH" \
  -H "Content-Type: application/json" \
  -d '{"provider":"...","label":"...","apiKey":"...","baseUrl":"...","modelNameOverrides":{},"priority":0}'
```
```ts title="TypeScript"
const key = await mt.modelKeys.create({ provider: "DeepSeek", label: "Production", apiKey: process.env.DEEPSEEK_API_KEY! });
```
```python title="Python"
mt.model_keys.create(provider="DeepSeek", label="Production", api_key=os.environ["DEEPSEEK_API_KEY"])
```

## `modelKeys.delete`

```http
DELETE /tenants/self/model-keys/by-id/{id}
```

Deletes a key. Runs already going stop using it at their next model call.

**Who can call it:** Tenant admins only, with an API key or a portal session. [Try it in the API playground](https://docs.maitento.com/playground/?call=DELETE%20%2Ftenants%2Fself%2Fmodel-keys%2Fby-id%2F%7Bid%7D).

**Path parameters**

| Name | Type | Required | Description |
|---|---|---|---|
| `id` | `uuid` | yes |  |

**Response:** no body (204)

```bash title="curl"
curl -X DELETE "https://api.maitento.com/tenants/self/model-keys/by-id/<id>" \
  -H "Authorization: $MAITENTO_AUTH"
```
```ts title="TypeScript"
await mt.modelKeys.delete("8d7c6b5a-4f3e-4d2c-9b1a-0f9e8d7c6b5a");
```
```python title="Python"
mt.model_keys.delete("6f7a8b9c-0d1e-4f2a-9b3c-4d5e6f7a8b9c")
```

## `modelKeys.update`

```http
PUT /tenants/self/model-keys/by-id/{id}
```

Replaces a key's settings (label, endpoint, overrides, priority, enabled); `apiKey` replaces the key itself.

**Who can call it:** Tenant admins only, with an API key or a portal session. [Try it in the API playground](https://docs.maitento.com/playground/?call=PUT%20%2Ftenants%2Fself%2Fmodel-keys%2Fby-id%2F%7Bid%7D).

**Path parameters**

| Name | Type | Required | Description |
|---|---|---|---|
| `id` | `uuid` | yes |  |

**Request body:** [`TenantModelKeyUpdateRequest`](https://docs.maitento.com/reference/types/tenant-model-key-update-request.md)

| Field | Type | Required | Description |
|---|---|---|---|
| `label` | `string \| null` |  | A name for the key, 1–100 characters. |
| `baseUrl` | `string \| null` |  | The endpoint to call instead of the provider's default; null or absent clears it. |
| `modelNameOverrides` | `map<string, string> \| null` |  | Map from a model's id at the provider to the name the endpoint serves it under; null or absent clears it. |
| `priority` | `integer` |  | Failover order among the tenant's keys for this provider, lower first (0–1000). |
| `isDisabled` | `boolean` |  | Whether the key is disabled. A disabled key is kept but never used. |
| `apiKey` | `string \| null` |  | A replacement key. Null or absent keeps the stored key. |

**Response:** [`TenantModelKey`](https://docs.maitento.com/reference/types/tenant-model-key.md) (200)

```bash title="curl"
curl -X PUT "https://api.maitento.com/tenants/self/model-keys/by-id/<id>" \
  -H "Authorization: $MAITENTO_AUTH" \
  -H "Content-Type: application/json" \
  -d '{"label":"...","baseUrl":"...","modelNameOverrides":{},"priority":0,"isDisabled":false,"apiKey":"..."}'
```
```ts title="TypeScript"
await mt.modelKeys.update("8d7c6b5a-4f3e-4d2c-9b1a-0f9e8d7c6b5a", { label: "Production", priority: 0, isDisabled: true });
```
```python title="Python"
mt.model_keys.update("6f7a8b9c-0d1e-4f2a-9b3c-4d5e6f7a8b9c", label="Production", priority=1, is_disabled=False)
```