| method | path | purpose |
|---|---|---|
PUT | /v1/secrets/providers/{provider} | Store your provider key ({value}). Validated against the provider at paste time; write-only forever after. |
PUT | /v1/secrets/providers/{provider}/keys/{key_id} | A named slot in your key SET ({value, label?, priority?} — lower priority = preferred). |
DELETE | /v1/secrets/providers/{provider} (or /keys/{key_id}) | Remove a credential. With none left, frontier calls fail clearly — we never fall back to our own accounts. |
GET | /v1/secrets | Names + presence + per-provider seat availability (availability) + your key-set metadata (provider_keys). Never values. |
PUT/DELETE | /v1/secrets/{name} | General secrets (write-only values), for your own use. |
Providers today: openrouter, together, novita. With several stored, calls route
across your accounts: your priority order first, measured speed second. A
rate-limited or failing credential is skipped automatically; a revoked or out-of-credit
key fails fast with the provider named and where to fix it.