Use a Virtual Key

Send a LiteLLM Virtual Key as the bearer token when you call the gateway.

How it works

LiteLLM looks up the Virtual Key in each request's Authorization header to identify the caller. Use the key issued for this gateway; model-provider credentials are configured on the gateway separately.

Prerequisites

Get a Virtual Key, the gateway URL, and an available model name from your administrator. Administrators can create and manage Virtual Keys and configure their permissions in Access Management.

Setup

Set the gateway URL and your Virtual Key in your client environment:

export LITELLM_PROXY_URL="https://litellm.example.com"
export LITELLM_API_KEY="<your-virtual-key>"

Test authentication

Call a model available to the key. Replace my-model with its configured model name:

curl "$LITELLM_PROXY_URL/v1/chat/completions" \
  -H "Authorization: Bearer $LITELLM_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "my-model",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

The request should return a model response. If authentication fails, confirm the key and gateway URL came from the same administrator.

Troubleshooting

Check that the key is active, has not expired, and is sent as Authorization: Bearer <key>. For a model-access denial, ask your administrator to check the key's model permissions.

Related guides

Use the OpenAI SDK examples or Client Setup to configure your application. To send your identity provider's token directly, see identity provider setup or OAuth 2.0 provider setup.