Proxy Keys

Proxy keys are the core of Meridian's security model. They let your applications call LLM APIs without ever exposing real provider credentials.

What are proxy keys?

A proxy key is a Meridian-generated API key that starts with sk-mrd-. When your application sends a request with a proxy key, Meridian:

1. Verifies the proxy key against stored SHA-256 hashes
2. Identifies which user owns the key
3. Decrypts the user's provider key (AES-256-GCM) for the target model
4. Forwards the request to the correct provider API
5. Logs the request with cost, latency, and token metrics
6. Returns the response in OpenAI-compatible format

Your real provider key is decrypted in memory for the duration of the outbound request and discarded immediately after.

Creating a proxy key

Navigate to the Keys page in the dashboard and click Create Key. Give it a descriptive name to identify its purpose (e.g., prod-backend, staging-chatbot).

You can also create keys via the API:

curl -X POST https://your-meridian.vercel.app/api/keys \
  -H "Content-Type: application/json" \
  -H "Cookie: next-auth.session-token=YOUR_SESSION" \
  -d '{ "name": "prod-backend" }'

Using a proxy key

Pass the proxy key in the Authorization header as a Bearer token when calling any /api/v1/* endpoint:

curl -X POST https://your-meridian.vercel.app/api/v1/chat/completions \
  -H "Authorization: Bearer sk-mrd-your-proxy-key-here" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o",
    "messages": [{ "role": "user", "content": "Hi" }]
  }'

Meridian proxy keys work with any HTTP client and are compatible with the OpenAI SDK — just change the base URL and API key:

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: "sk-mrd-your-proxy-key-here",
  baseURL: "https://your-meridian.vercel.app/api/v1",
});

const completion = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Hello!" }],
});

Revoking a proxy key

If a key is compromised or no longer needed, revoke it from the Keys page by clicking the Revoke button. Revoked keys are immediately rejected on all subsequent requests.

You can also revoke via the API:

curl -X DELETE https://your-meridian.vercel.app/api/keys \
  -H "Content-Type: application/json" \
  -H "Cookie: next-auth.session-token=YOUR_SESSION" \
  -d '{ "id": "KEY_ID_HERE" }'

Revocation is permanent. If you need access again, create a new key.

Best practices

• Create separate keys per environment (development, staging, production).
• Use descriptive names so you can identify keys in usage logs.
• Rotate keys periodically — revoke old ones and create replacements.
• Never commit proxy keys to version control. Use environment variables.
• Monitor the lastUsedAt field to detect stale or suspicious keys.