Store AI key management on Vareons (/dashboard/ai-usage/api-keys)
The /dashboard/ai-usage/api-keys page manages your store AI keys per supported provider: status with masked previews only, plus add, save, and test actions, with envelope encryption, rate limits, and a per-save challenge nonce.
Last verified: 2026-09-19
Key management lives at /dashboard/ai-usage/api-keys inside the protected dashboard, opened through the Add API Key button on the usage page. The CopilotProviderKeysPanel shows each supported provider — OpenAI, Anthropic, Google Gemini, Mistral, xAI Grok, Qwen, Kimi, OpenCode Zen, and OpenCode Go — with a masked preview of any saved key and never the raw text.
Keys are managed through GET/POST /api/ai-copilot/settings. Reads return status only; writes require a fresh nonce from the challenge path GET /api/ai-copilot/settings/challenge, and are rate-limited plus shape-validated per provider. Storage uses AES-256-GCM envelope with HMAC under a per-tenant data key (AICopilotTenantKey), and no secrets or prompts are written to activity logs: the ai_copilot ActivityEvent carries provider id, action, and key version only.
After a successful save you can test the key through the test path before relying on it as the tenant chat source. If you keep the chat source on platform, you stay on Vareons keys and your plan free quota with no private key needed.
Setup steps in Vareons
Open the keys page
From /dashboard/ai-usage press Add API Key to reach /dashboard/ai-usage/api-keys. You will see each provider status with a masked preview of any saved key.
Add the provider key
Pick the provider and paste your API key into its field. Avoid screen-sharing while pasting, and confirm the key matches that provider format.
Save through the nonce challenge
Press save: the client fetches a fresh nonce from the challenge path and sends it with the rate-limited request. On success an audit event is recorded without any secret, and status shows saved.
Test, then use the tenant source
Run the key test from the panel, then pick keySource tenant in the assistant so chat runs on your store key and its current limits.
Frequently asked questions
Is my key shown in plain text after saving?
No. The UI shows a masked preview only, the server never returns the raw value, and storage is AES-256-GCM envelope encrypted with HMAC.
Why does saving require a fresh nonce?
To prevent request replay: every save needs a fresh nonce from the challenge path under rate limits, otherwise it is rejected.
Do I need a private key on the platform source?
No. The platform source runs on Vareons keys with your plan monthly free quota; a private key is needed only for the tenant source.
Which providers are supported for keys?
OpenAI, Anthropic, Google Gemini, Mistral, xAI Grok, Qwen, Kimi, OpenCode Zen, and OpenCode Go, each validated against its own key shape.
Are my prompts or keys stored in the activity log?
No. The ai_copilot event records provider id, action, and key version only, without secrets, previews, or prompts.
Troubleshooting
Save or test failed? 1) If the nonce is rejected, reopen the page for a fresh nonce, then save once. 2) If the key shape is rejected, confirm you pasted the right provider key without extra spaces. 3) If the test fails after a good save, check the provider balance, key permissions, and limits. 4) If you hit the rate limit, wait briefly, then retry.
Important limitations
• Keys are tenant-scoped and do not work across stores. • Previews are always masked; the raw value cannot be recovered. • Save and test are rate-limited. • The provider's own limits (balance, quota) still apply above Vareons settings.