Secrets management
Manage API keys, provider credentials, and other secrets in AISIX deployments.
AISIX needs credentials for upstream LLM providers, downstream callers, and the cloud control plane. This guide describes how to store and rotate those secrets safely.
Provider keys
- Provider keys are configured per upstream or provider object. Use the AISIX Dashboard, Admin API, or configuration files to set them.
- Do not commit provider keys to source control. Store them in a secrets manager and inject them at deployment time.
- Rotate provider keys before they expire or after a suspected leak. After rotation, update the provider configuration and reload the gateway group.
Caller API keys
For downstream authentication and per-caller rate limits, see Caller API keys.
Control plane tokens
- Admin tokens grant access to the AISIX Enterprise Admin API. Create them with minimal scope and rotate them on a regular schedule.
- Use teams and roles and custom roles to limit token privileges.
TLS and mTLS secrets
- mTLS certificates for the gateway and control plane should be stored as Kubernetes Secrets or in an external secrets operator.
- See TLS and mTLS for certificate configuration.
Rotation and audit
- Maintain a list of all secrets, owners, and expiry dates.
- Rotate credentials on a schedule or after team member changes.
- Audit access through logging and auditing.