Provider Keys

Connect an account-level Anthropic, OpenAI, or Amazon Bedrock Provider Key once, where available, so model routers can call closed families without developers sending the key.

Connect an Anthropic, OpenAI, or Amazon Bedrock key once to let FireRouter call closed models. After that, developers and gateways authenticate with only their Fireworks API key. When FireRouter selects a closed model, Fireworks sends the request with the stored provider credential.

Provider Keys is not yet available on every account. If Provider Keys does not appear in Settings, contact the Fireworks team to enable it. Self-serve setup is coming soon. Until then, send a per-request Anthropic or OpenAI header from APIs and SDKs or LLM Gateways. For coding harnesses, review local support in Harness Compatibility.

FireConnect configures the developer’s Fireworks credential through fireconnect login. The provider key stays with the account, so it is never distributed to developers or pasted into a chat. Fireworks encrypts it at rest and never shows it in full again.

Admin: connect the provider key once. Developer: run fireconnect login. Request: send only the Fireworks API key.

Router availability in FireConnect varies by harness. See Harness Compatibility for current support.

Provider Keys is an account-admin-only feature. You must be an account admin to connect, replace, or remove a key, whether from the dashboard or through firectl.

Check provider support and connection states

• Providers: The dashboard supports Anthropic, OpenAI, and Amazon Bedrock. The API and firectl support those providers, plus Grok when enabled for your account.
• One active key per provider: You can upload several keys for one provider, but only one can be active for routing at a time.
• Bedrock also needs routes: a Bedrock key is not enough. Each model you want to send through your AWS account needs a Bedrock model ID and region. See Amazon Bedrock.

Each provider is always in one of these states:

State	What it means
Connected	The key is active for router requests to that provider
Connecting	A new binding is propagating
Disconnecting	A binding removal is propagating
Not connected	No key is set for this provider.

Connect a key in the dashboard

Connect a Provider Key from Settings without using a terminal. You can open Provider Keys directly.

1. Open Provider Keys

   Open Settings and go to Provider Keys, or open the Provider Keys page directly.

2. Connect a provider

   Find the provider you want (Anthropic, OpenAI, or Amazon Bedrock) and click Connect.

3. Paste your key

   For Anthropic or OpenAI, paste your key and click Connect. You will see a confirmation once it is saved.

   For Amazon Bedrock, paste the key and select models. After the card connects, fill in each model’s Bedrock model ID and region, then click Save. Full steps are in Amazon Bedrock.

The provider then shows Connected. Requests typically begin using the key within 30–60 seconds of connecting it. Bedrock traffic starts only after the model routes are saved.

Replace or remove a key

Open the menu on any connected provider to:

• Replace: swap in a new key value for that provider. Bedrock routes stay in place when you update only the key.

• Remove: remove the key. For Bedrock, this also deletes every Bedrock route.

Changes typically propagate within 30–60 seconds. The provider may briefly show Connecting or Disconnecting.

Manage keys with firectl

You can also connect, replace, remove, and inspect Provider Keys with firectl. Use firectl provider-key to manage stored keys and firectl provider-key-binding to choose which key is active for routing. firectl firerouter-provider-key is an alias.

The CLI can also stop using a key for routing without deleting it (provider-key-binding unbind). The key remains stored, so you can bind it again without re-uploading it.

First time using firectl? Follow Getting started to install it.

Action	Step	Command
Connect or replace	Upload a key	firectl provider-key upload --provider-type PROVIDER --api-key $PROVIDER_KEY / --from-file PATH
	Use the key	firectl provider-key-binding bind PROVIDER KEY_ID
	Use a Bedrock key	firectl provider-key-binding bind bedrock KEY_ID --routes-file=./routes.json
Check status	Check stored keys	firectl provider-key list / firectl provider-key list --provider-type PROVIDER
	Check keys in routing	firectl provider-key-binding list or firectl provider-key-binding get PROVIDER
Remove	Stop using a key (but keep stored)	firectl provider-key-binding unbind PROVIDER
	Delete (needs to stop first)	firectl provider-key delete KEY_ID

Add or replace a key

upload stores a key but does not make it active for routing. Use bind to make it active. --provider-type is required and accepts anthropic, openai, grok, or bedrock.

For the quickest Anthropic or OpenAI setup, pass an environment variable to --api-key. This keeps the value out of your shell history:

firectl provider-key upload --provider-type anthropic --api-key $ANTHROPIC_KEY
firectl provider-key-binding bind anthropic KEY_ID

You can also point at a file with --from-file. The file should hold only the raw key, with no JSON or quotes. firectl trims surrounding whitespace:

firectl provider-key upload --provider-type anthropic --from-file ./anthropic.key

On a shared or multi-user machine, prefer --from-file. The shell expands $ANTHROPIC_KEY before firectl starts, so --api-key keeps the key out of your shell history but still exposes it in the process list (ps) while the command runs. --from-file passes only the path.

To rotate a provider, upload the new key and bind that key’s ID. The old key stays stored until you delete it.

For Amazon Bedrock, upload with --from-file and bind with --routes-file. Omitting --routes-file binds an empty route set, which serves no Bedrock traffic and replaces any existing routes. See Amazon Bedrock.

Check status

# Keys you have uploaded (vault). One provider can have several.
firectl provider-key list
firectl provider-key list --provider-type openai
firectl provider-key list -o json

# Which key is live for each provider (Connected / Connecting / Disconnecting / Not connected)
firectl provider-key-binding list
firectl provider-key-binding list --provider-type openai
firectl provider-key-binding get openai

provider-key list shows each stored key’s ID, provider, masked preview, and display name. provider-key-binding list and get show each provider’s connection state and active key_id. For Bedrock, also confirm that routes lists every model you intend to send through AWS.

Delete a key

Use the key_id from upload or provider-key list. If that key is live for the provider, unbind it first. Unbind stops routing from using it; the key stays stored until you delete it.

# If this key is currently in use
firectl provider-key-binding unbind openai
firectl provider-key delete KEY_ID

Key behavior and security

• Request-level credentials take precedence when supported. If a request includes a provider key, that key is used and the stored one is skipped.
• Changes are not instant. After you connect, replace, or remove a key, allow 30–60 seconds for the change to reach requests.
• Your key stays private. The full key is stored securely and never returned. The dashboard and API only show the provider, state, masked preview, and dates.