One API Key for All LLMs
Unify the Interface, Not the Secrets
一个 API 密钥访问所有 LLM：统一接口，不共享上游密钥
The safe pattern is one application-facing virtual key resolved by a gateway. Upstream provider keys stay isolated in a vault and are selected only after policy evaluation.
安全模式是由网关解析一个面向应用的虚拟密钥。上游供应商密钥隔离保存在密钥库中，只在策略评估后选择。
TL;DR
Bind the app key to service identity, tenant, environment, owner and expiry.
Allow workloads and model capabilities, not an unrestricted list of provider names.
Fetch scoped upstream credentials inside the gateway and never return them.
Record principal, policy version, candidate routes, selection, usage and outcome.
把 App 密钥绑定到 Service Identity、租户、Environment、Owner 与 Expiry。
授权工作负载与模型能力，而不是无限制的供应商名单。
在网关内获取受限上游凭证，且永不返回应用。
记录 Principal、策略版本、候选路由、选择、用量与结果。
What one key should and should not mean “一个密钥”应与不应意味着什么
One app key simplifies client configuration and centralizes governance. It should not become a broad shared secret with permanent access to every provider, model and environment.
一个 App 密钥可简化客户端配置并集中治理，但不应变成永久访问所有供应商、模型与环境的宽泛共享上游密钥。
The gateway maps the authenticated principal to a versioned policy. Provider adapters use separate credentials with the least scope available. Rotation or provider changes do not require distributing new secrets to every application.
网关将认证 Principal 映射到版本化策略；供应商适配器使用权限尽可能小的独立凭证；轮换或更换供应商无需向每个应用分发新上游密钥。
Unified credential patterns 统一凭证模式
| Pattern 模式 | Best fit 最适合 | Verify before choosing 选择前验证 |
|---|---|---|
| Opaque virtual key 不透明虚拟密钥 | Server application needs a simple bearer credential. 服务端应用需要简单 Bearer Credential。 | Entropy, one-time display, hashing, scope, expiry and revocation. 核对熵、一次展示、哈希、范围、过期与吊销。 |
| Identity token Identity Token | Workload identity platform can issue short-lived tokens. 工作负载 Identity Platform 可签发短期 Token。 | Issuer, audience, signature, claims, clock skew and key rotation. 核对 Issuer、Audience、Signature、Claim、时钟偏差与密钥 Rotation。 |
| Gateway-managed SDK 网关管理 SDK | Teams need provider-neutral client configuration and telemetry. 团队需要供应商中立客户端配置与遥测。 | SDK trust, update policy, fallback semantics and offline behavior. 核对 SDK 信任、更新策略、故障切换语义与离线行为。 |
| Direct provider keys 直接供应商密钥 | An exceptional path requires native access. 例外路径需要原生访问。 | Broad scope, secret distribution, fragmented audit and rotation burden. 核对宽泛权限、上游密钥分发、分散审计与轮换负担。 |
Policy attached to the key 密钥绑定的策略
Tenant, project, service, environment, owner and purpose.
Approved model families, tools, modalities, regions and data classes.
Requests, tokens, concurrency, spend, priority and reset windows.
Creation, use, policy changes, rotation, expiry, revocation and deletion.
租户、Project、Service、Environment、Owner 与 Purpose。
获批模型族、工具、模态、区域与数据分类。
请求、Token、并发、支出、优先级与重置窗口。
创建、使用、策略变更、轮换、过期、吊销与删除。
Red-team unified access 红队测试统一访问
- Attempt wrong-tenant, wrong-model, expired and revoked-key requests.
- Verify provider secrets never enter responses, logs, traces or client bundles.
- Rotate every upstream credential while applications keep their virtual key.
- Test policy rollback, budget exhaustion and a compromised-key kill switch.
- 尝试错误租户、错误模型、过期与已吊销密钥请求。
- 验证供应商上游密钥永不进入响应、日志、调用链或客户端 Bundle。
- 轮换所有上游凭证，同时应用保持原虚拟密钥。
- 测试策略回滚、预算耗尽与密钥泄露 Kill Switch。
Resolve one key into many isolated credentials 将一个密钥解析为多个隔离凭证
The gateway authenticates the application virtual key, resolves an internal principal and evaluates workload policy. A capability router selects an approved adapter. The adapter retrieves only the matching provider credential from a vault, executes the call and returns normalized output plus native evidence.
网关验证应用虚拟密钥、解析内部 Principal 并评估工作负载策略；能力路由器选择获批适配器；适配器从密钥库只获取匹配供应商凭证，执行调用并返回标准化输出与原生证据。
Production rule: one application key must never be implemented as one plaintext provider secret shared across systems.
生产规则：一个应用密钥绝不能实现为跨系统共享的明文供应商上游密钥。
Use separate scopes for inference and tools 为推理与工具使用独立 Scope
The model gateway uses the virtual key for inference policy. QVeris governs external APIs, tools, services and live data through Discover → Inspect → Call. Bind both to the same principal when useful, but keep credentials, budgets and audit trails separate.
模型网关使用虚拟密钥执行推理策略；QVeris 通过 Discover → Inspect → 调用治理外部 API、工具、服务与实时数据。两者可绑定同一 Principal，但应保持凭证、预算与审计轨迹分离。
Define the Production Contract for one API key for all LLMs定义一个密钥访问全部 LLM的生产契约
For One API Key All LLMs, protocol similarity lowers integration effort, but it does not guarantee behavioral parity. Put a versioned application contract between product code and the provider path so change remains testable and reversible.
针对“一个密钥访问所有 LLM”，协议相似可以降低集成工作量，却不能保证行为等价。应在产品代码与供应商路径之间建立版本化应用契约，让变更保持可测试、可回滚。
Document virtual identity, tenant and environment scope, upstream credential isolation, model allowlists, budgets, audit fields, revocation, and break-glass access. Mark each item as required, optional, provider-native, or unsupported, and assign an owner for any transformation that changes its meaning.
记录虚拟身份、租户与环境 Scope、上游凭证隔离、模型白名单、预算、审计字段、撤销和紧急访问。把每一项标记为必需、可选、供应商原生或不支持，并为任何改变语义的转换明确负责人。
To validate One API Key All LLMs, create fixtures for short and long prompts, Unicode, streaming, JSON schema, parallel tools, refusals, cancellation, malformed input, and rate limits. Check required fields and event order instead of accepting one plausible text answer.
验证“一个密钥访问所有 LLM”时，为短与长提示词、Unicode、流式、JSON Schema、并行工具、拒绝、取消、畸形输入和限流建立 Fixture，检查必需字段与事件顺序，而不是接受一个看似合理的文本答案。
When operating One API Key All LLMs, trace internal request ID, resolved model and provider, model version, transformations, retries, latency, token classes, cost source, policy result, and output validation. Redact secrets without deleting the context needed to reproduce failure.
运营“一个密钥访问所有 LLM”时，追踪内部请求 ID、解析后的模型与供应商、模型版本、转换、重试、延迟、Token 类别、成本来源、策略结果和输出校验，在脱敏密钥的同时保留复现失败所需上下文。
Before rolling out One API Key All LLMs, shadow representative traffic, classify semantic differences, canary by reversible workload, monitor task completion and tail behavior, and keep the previous route available until rollback and return-to-primary have been rehearsed.
上线“一个密钥访问所有 LLM”前，运行代表性影子流量，分类语义差异，按可逆工作负载进行金丝雀发布，监控任务完成与长尾行为，并在演练回滚和恢复主路径之前保留原有路由。
FAQ
No. It should expose only policy-approved capabilities for that workload.
In a protected server-side vault, never in applications or prompts.
Yes. Revoking its virtual credential should not affect unrelated provider keys.
不会。它只应暴露该负载获策略批准的能力。
存于受保护的服务端密钥库，绝不进入应用或提示词。
可以。吊销其虚拟凭证不应影响无关供应商密钥。