Axemere.ai

Scenario: Credential Rotation

Rotate AI provider API keys without touching application code or restarting the gateway. Credentials are stored by logical name in the gateway: updating the key behind that name takes effect on the next request, across your entire fleet, with no downtime.

Rotating a credential in the console

For Control Plane (CP)-connected deployments, credentials are managed in the console and synced to all nodes automatically.

  1. Go to Credentials in the left nav
  2. Find the credential you want to rotate
  3. Click the credential to open it, then click Edit
  4. Paste the new API key and click Save

The new key is pushed to all connected gateway nodes within seconds. No restart required. In-flight requests using the old key complete normally.

Zero-downtime rotation

For critical workloads where you want to verify the new key before revoking the old one:

  1. Go to Credentials and click Add Credential
  2. Create a new credential (e.g. cred-openai-prod-v2) with the new key
  3. Update any policy rules that reference the old credential to point to the new one (Policies → Advanced, update select_credential.credential_id)
  4. Send a test request and confirm it succeeds using the new credential
  5. Revoke the old key in the provider dashboard (OpenAI, Anthropic, etc.) once confirmed
  6. Delete the old credential from the console

Rotating a credential on the Free Gateway

For standalone Free Gateway deployments, update the credential via the admin API:

curl -s -X PATCH http://localhost:7080/v1/admin/credentials/cred-openai-prod \
  -H "MVGC-Admin-Token: $MVGC_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"key_value": "sk-new-key-value-here"}' | jq .

The gateway uses the new key on the next request.

Verifying the active credential

After rotating, confirm the new credential is being used by checking a recent execution record in the console under Records. The credential ID is shown in the record detail.