Skip to main content

LLM gateway access control

Control which agents can use the LLM gateway by issuing, rotating, and revoking gateway keys. Each agent, whether a local Claude Code instance or a MintMCP Coworker Agent, authenticates with its own key, so you can revoke a single agent's access without touching others.

Gateway keys​

A gateway key is a long-lived credential that authenticates an agent to the LLM gateway endpoint. It is presented as a standard bearer token: the agent sets it as the API key when configuring the gateway as its model endpoint.

Each key:

  • Authenticates to one organization's gateway and only that gateway.
  • Is scoped to the agent or team it was issued for, so usage in the audit log is attributed to the right identity.
  • Can be revoked immediately: the gateway rejects the key on the next request with no grace period.

Issue a key​

  1. In MintMCP, go to LLM Gateway → Access.
  2. Click + New key.
  3. Enter a name (for example, "john-doe-claude-code" or "coworker-ops-agent") and an optional expiry.
  4. Copy the key. It is shown only once, so store it in a secret manager or use it immediately in your agent's configuration.

Rotate a key​

Rotate a key by overlapping the new and old keys so the agent keeps running: issue the new key, roll it into the agent, confirm the agent is using it, then revoke the old one.

  1. Issue a new key for the same agent (step above).
  2. Update the agent's configuration to use the new key.
  3. Once the agent is running with the new key, revoke the old one from the Access table.

Revoke a key​

  1. In MintMCP, go to LLM Gateway → Access.
  2. Find the key in the table and click Revoke.

Revocation is immediate. Any agent request using the revoked key receives a 401 Unauthorized response.

Key expiry​

When you create a key, you can set an expiry of 30 days, 90 days, 1 year, or no expiry. An expired key is rejected the same way a revoked key is, and it stays listed in the table with an "Expired" badge so you can clean it up and track rotation history.

Prefer short expiries for automated pipelines and treat "no expiry" as the exception for long-lived service agents.

Per-agent keys​

Issue one key per agent rather than sharing a single key across agents. Separate keys mean:

  • Attribution: each agent's model calls appear separately in usage and audit logs.
  • Blast radius: revoking one agent's key doesn't affect others.
  • Rotation: you can rotate each agent's key on its own schedule.

For Coworker Agents, store the key as a declared secret (secret_keys in agent.yml) and reference it in the harness configuration. See Configure a Coworker Agent.

Next steps​