---
title: "Update Model Gateway credentials"
method: PUT
path: "/api/ai/config"
tags: ["Admin"]
---

# Update Model Gateway credentials

`PUT /api/ai/config`

Stores one or both OpenRouter credentials as encrypted reserved secrets in a self-hosted deployment. Credentials are independent and may be updated separately.

## Request body

- UpdateModelGatewayConfig
  - `apiKey` string — OpenRouter API key used for model requests.
  - `managementKey` string — OpenRouter management API key used only for activity analytics.

## Response `200`

Updated masked Model Gateway credential status

- ModelGatewayConfig
  - `apiKey` ModelGatewayCredentialStatus, required
    - `configured` boolean, required — Whether the credential resolves from encrypted settings or the supported API-key environment fallback.
    - `maskedKey` string, nullable, required — Masked credential for display, or null when it is not configured.
  - `managementKey` ModelGatewayCredentialStatus, required
    - `configured` boolean, required — Whether the credential resolves from encrypted settings or the supported API-key environment fallback.
    - `maskedKey` string, nullable, required — Masked credential for display, or null when it is not configured.

## Other responses

- `400` — Invalid payload or configuration is managed by InsForge Cloud
- `401` — Unauthorized
- `500` — Failed to update encrypted credentials

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)