Type: LLM, MCP, or both
An application’s type is not something you pick up front — it follows from what you give it. Add a model provider and it serves LLM traffic; add an MCP server and it serves MCP; add both and it is both, on two endpoints.
An application with neither is not yet an application: it has nowhere to serve,
and you cannot finish creating one until you add a provider or a server.
One key, every plane
An application has one key, and that key opens every plane it has. A client holds one secret no matter how many planes it talks to. The key is shown once. The gateway keeps only its head and tail — enough to recognise it in a list, not enough to reconstruct it — so a key not captured at issue time is gone and has to be replaced. Revoking is total and immediate: the key stops working on every plane at once, and anything still using it starts failing to authenticate. There is no partial revoke, which is the argument for one key per deployed thing rather than one key shared across three. Rotating mints a new secret and keeps everything else — the name, and every plane the key opened. The old secret stops working the moment the new one is shown, so deploy the new one first and rotate when it is in place. A key can also be given an expiry, or none. An expired key is refused exactly like an unknown one, so a job that outlives its key fails to authenticate rather than degrading. The SDK reads the date from the key itself, which is how a long run can refuse to start instead of stopping halfway.What it may use
An application names the registry entries it may reach, and can narrow further within them: specific models on a provider, specific tools on a server. That narrowing is the difference between “this service can reach our OpenAI account” and “this service can callgpt-4o-mini and nothing else”. It is the
cheapest control in the product, because it fails closed at the gateway and needs
no policy evaluation to do it.
How models are picked
When an application can reach more than one model destination, a strategy decides which one a request goes to:
Tool traffic routes to a single server, so these apply to models only. See
Routing for model order, conversation
setup and Prioritize quality over savings.
Who a call runs as
There is nothing to configure here. The key proves the application; each call says who it is for:
The first two rows are the same key, one call at a time: a nightly job and a
customer-facing assistant can be the same application, because nothing declares
in advance which one it is allowed to be. The third is the other door — an
application that gets in with a token has no key to send. See
acting for end users for the middle row.
The id in the header is yours to choose and the gateway namespaces it by
application, so two applications naming
user_123 never reach the same account.
Only the application’s own credential may assert one: a person signed in with
their own account is already that person, and cannot name someone else.
That middle row is also the boundary with Access. People your application names
are your product’s users, not your identity provider’s, so Access levels and
grants do not apply to them.