Settings

Provider keys

The keys Dvar's judges use to call model providers. They stay in your data plane, sealed. After you save a key, nobody sees it again.

Only a member adds a key.

Your redacted text and images may go to inference.dvarlabs.ai, Dvar's hosted models, which does not store them. One yes from a member covers every workflow. You can withdraw any time.

No answer yet. There is no Dvar key until a member allows it.

Dvar

Dvar needs your yes first. Allow bank data to go to inference.dvarlabs.ai above; then add the key Dvar sends you on this page. Go to the consent question

Providers

  • Dvar No key yet
  • Anthropic No key yet
  • OpenAI No key yet
  • OpenRouter 1 key
  • Azure OpenAI No key yet
  • AWS Bedrock No key yet
  • GCP Vertex No key yet

How your keys are kept

  • Kept in your data plane. Keys are stored in this data plane's Postgres. Dvar's cloud never receives them.

  • Sealed at rest. Each key is encrypted (AES-256-GCM) with a key-encryption key held outside the database.

  • Write-only. You paste a key once. After that, only its last 4 characters show. No one can read it back, here or in the API.

  • Never logged. Not in logs, errors, traces or test results. Provider error text is never shown, because it can repeat the key.

  • Tested before it is saved. The Dvar connector sends one fixed request with no customer data to the provider, only if its policy names that provider. If it fails, nothing is stored.

  • Used only inside your data plane. Only the Dvar connector uses a saved key: for the key test, and for the judge calls of a workflow bound to it (Anthropic or Dvar), through its egress policy. The workflow's Models page picks the key and model for each step.

  • One person can revoke. Revoke works at once. The sealed key is deleted; the audit log keeps its name and last 4.

Keys. One row per key. Open a row to see which workflow steps use it.1 key
KeySecretModelsStatusUsed byAdded
openrouter-demo-judgeOpenRouter
—
Claude Sonnet 5.5 · default1 model loaded
Active
1 workflow · judges, comparisonsabcl-servicing-intent
20 Oct

Models of openrouter-demo-judge

One per line. The first is the model the key test uses.

Revoke openrouter-demo-judge?

These stop working at once:

  • abcl-servicing-intent: its judge calls fail until you pick another key.
  • abcl-servicing-intent: its comparison calls fail until you pick another key.
  • The sealed key is deleted now. This can't be undone.
  • The audit log keeps its name and last 4.
  • Also revoke it at the provider.
——

Keyboard shortcuts

G H
Go to Home
?
This list