BLOCK 4 · AI GATEWAY (PRODUCTION) 3:20 – 3:30 · 10 min · 3L / 7HO · Lab

TOPIC 4.4 / 10 · HO #3

Create a Virtual Key

A Virtual Key is your gateway's representation of who is asking. Per-team, per-tenant, per-environment. The only secret your Vue app sees.

4.4

Virtual Key — identity, not just budget

10 min 3L / 7HO 3:20 – 3:30

Slide 1 / 3 · VK as identity

A Virtual Key is who is asking

Per-team, per-customer, per-tenant, per-environment
Budget attaches to it (one VK, multiple budgets — see 4.5)
Routing rules can target it
Logs attribute to it
Provider/model allowlist lives on the VK — one key can express its own mini-routing policy (provider_configs with allowed_models + weights)
The only secret your Vue app sees

Slide 2 / 3 · Granularity choices

Pick the granularity that matches your spend view

Environment: prod-vk, staging-vk, dev-vk
Surface: web-app-vk, mobile-app-vk, admin-tools-vk
Tenant: customer-acme-vk, customer-globex-vk

Pick how you'd want to see the spend in a dashboard.

Slide 3 / 3 · Five clicks to VK created

HO #3 — Create a VK (7 min)

Sidebar → Governance → Virtual Keys
Click Create Virtual Key
Name: workshop-vk-1 · description: My workshop key
Save → use the copy button on the row (key is masked; eye icon reveals if needed)
Paste into .env as WORKSHOP_VK=... for Block 4.9

Speaker notes

Slide 1 — name the concept: "A Virtual Key is your gateway's representation of who is asking. Per-team, per-customer, per-tenant, per-environment. Budget attaches to it — and a VK can carry multiple budgets with different reset windows; we'll see that in 4.5. Routing rules can target it. Logs attribute to it. And the VK itself carries a provider/model allowlist and per-provider weights — one VK can express its own mini-routing policy. The big routing rules from 4.6 operate at the gateway layer; the VK's allowlist constrains what any single key is allowed to ask for. Two layers, both useful. This VK is the only secret your Vue app will see — in Block 4.9 when we wire the Nuxt app to the gateway, it'll send this VK as a Bearer token. That's it. No provider keys."

Auth header note (S1): "One footnote for production. Today we're using Authorization: Bearer <VK> — this works when Bifrost has admin auth disabled, which is our workshop setup. In production with admin auth enabled, Authorization is reserved for admin Basic credentials and the VK moves to the x-bf-vk header. Both shapes work; pick based on whether you've turned on enforce_auth_on_inference. If someone in your team asks 'why are you using Bearer?' — it's the OpenAI-compatible shape; switch to x-bf-vk when you turn auth on."

Slide 2 — granularity: "Production teams pick the granularity that matches how they want to see spend. Per environment? Per surface? Per customer? The answer is whatever you'd want to see in your billing dashboard. Mixed is fine too."

Slide 3 — HO: "Seven minutes. Governance → Virtual Keys → Create. Name it workshop-vk-1. The key string is masked by default in the dashboard — but the row has a show button (eye icon) and a copy button. Hit copy. You don't have to reveal it. Paste it into your .env as WORKSHOP_VK=... — you'll use it in Block 4.9 to authorize your Nuxt app against Bifrost."

During HO: loop the room. If anyone says "I lost the key" — delete the VK and recreate. Cheap operation.

Demo piece — Attendees

Click sequence:

Sidebar → Governance → Virtual Keys
Create Virtual Key
Form: Name workshop-vk-1, Description My workshop key
Save
Click the copy button on the row (key string is masked; eye icon shows if needed)
Open .env in editor → WORKSHOP_VK=<paste> → save

Instructor mirror on projector. Make a show of clicking the copy button — it primes attendees to actually do it.

Common gotchas:

Key string is masked by default — use the copy button on the row to get it onto your clipboard. The show button (eye icon) reveals it inline if you really want to see the characters; you don't need to.
.env not auto-reloaded by Nuxt → only matters in Block 4.9; not now