portkey-admin-mcp

create_virtual_key

Store a provider API key as a virtual key and return its slug; save the slug because the encrypted key is only shown at creation.

Instructions

Store a provider API key as a virtual key. The raw key is encrypted and only returned at creation time, so save the returned slug and use it in prompts/configs. Optional usage and rate limits apply immediately, and the tool returns the new slug.

Input Schema

Name	Required	Description
`key`	No	Provider API key; omit when secret_mappings supplies key
`name`	Yes	Display name for the virtual key
`note`	No	Optional note or description for this key
`provider`	Yes	Provider slug (e.g., 'openai', 'anthropic', 'azure-openai', 'google')
`expires_at`	No	Expiration in ISO 8601 format
`api_version`	No	API version (for Azure OpenAI)
`credit_limit`	No	Maximum usage cost threshold
`workspace_id`	No	Workspace ID to create the key in
`resource_name`	No	Resource name (for Azure OpenAI)
`rate_limit_rpm`	No	Requests per minute limit
`alert_threshold`	No	Percentage of credit_limit at which to send alert emails (0-100)
`deployment_name`	No	Deployment name (for Azure OpenAI)
`secret_mappings`	No	Secret Reference mappings for key or model_config fields
`deployment_configurations`	No	Azure deployment configurations with API versions and aliases

Output Schema

Name	Required	Description
`ok`	Yes	Whether the tool call succeeded and returned structured data
`data`	No	Structured success payload when ok is true
`error`	No	Structured error payload when ok is false

Schema Changelog

Changes observed during successful MCP inspections.

Changed2 schema fields changedv1.0.9Oct 26, 2026

changedInput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

changedOutput schema / $schema

Previous value: -"http://json-schema.org/draft-07/schema#"New value: +"https://json-schema.org/draft/2020-12/schema"

Changed3 schema fields changedv0.12.2Oct 2, 2026

changedInput schema / properties / expires_at / pattern

Previous value: -"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"New value: +"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"

removedInput schema / properties / secret_mappings / items / properties / secret_key / anyOf
```
Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]
```
addedInput schema / properties / secret_mappings / items / properties / secret_key / type
```
Added value: +[
+  "string",
+  "null"
+]
```

Changed5 schema fields changedv0.11.5Sep 8, 2026

addedInput schema / properties / deployment_configurations

Added value: +{
+  "description": "Azure deployment configurations with API versions and aliases",
+  "items": {
+    "properties": {
+      "alias": {
+        "description": "Optional model alias for the deployment",
+        "type": "string"
+      },
+      "api_version": {
+        "description": "Azure OpenAI API version",
+        "minLength": 1,
+        "type": "string"
+      },
+      "deployment_name": {
+        "description": "Azure deployment name",
+        "minLength": 1,
+        "type": "string"
+      },
+      "is_default": {
+        "description": "Whether this is the default Azure deployment",
+        "type": "boolean"
+      }
+    },
+    "required": [
+      "api_version",
+      "deployment_name"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / expires_at

Added value: +{
+  "description": "Expiration in ISO 8601 format",
+  "format": "date-time",
+  "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+  "type": "string"
+}

changedInput schema / properties / key / description

Previous value: -"The actual provider API key to store"New value: +"Provider API key; omit when secret_mappings supplies key"

addedInput schema / properties / secret_mappings

Added value: +{
+  "description": "Secret Reference mappings for key or model_config fields",
+  "items": {
+    "properties": {
+      "secret_key": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "Optional key selected from a structured external secret"
+      },
+      "secret_reference_id": {
+        "description": "Secret Reference ID that owns the external secret",
+        "type": "string"
+      },
+      "target_field": {
+        "description": "Virtual Key field populated from the Secret Reference",
+        "type": "string"
+      },
+      "value_format": {
+        "anyOf": [
+          {
+            "enum": [
+              "json",
+              "string"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "Whether Portkey reads the mapped value as JSON or a string"
+      }
+    },
+    "required": [
+      "target_field",
+      "secret_reference_id"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

changedInput schema / required

Previous value: -[
-  "name",
-  "provider",
-  "key"
-]New value: +[
+  "name",
+  "provider"
+]

Addedv1.0.1May 7, 2026
RemovedMay 1, 2026
First observedJan 1, 2026

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint=false, destructiveHint=false, openWorldHint=true, idempotentHint=false), yet the description still adds real behavioral facts: the raw key is encrypted and retrievable only at creation time, and optional usage/rate limits take effect immediately. It stops short of covering permissions, error conditions, or what happens on duplicate names.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with the core action front-loaded and no filler. Minor deduction because "the raw key is encrypted and only returned at creation time" reads ambiguously next to "save the returned slug" — a reader could momentarily think the raw key itself comes back.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 14-parameter create tool whose schema is fully documented and which has an output schema, the description covers what an agent needs to call it correctly: what is created, that the secret is write-only, and that the slug must be retained. The unmentioned alternative paths (secret_mappings vs. raw key) are documented in the schema itself.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% across all 14 parameters, so the schema already documents provider, expires_at, Azure fields, secret_mappings, and deployment_configurations. The description only gestures at the limit parameters ("optional usage and rate limits") without adding syntax or defaults, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: "Store a provider API key as a virtual key." That is clear enough to distinguish it from list/get/update/delete_virtual_key, but it never contrasts with the adjacent create_api_key or create_secret_reference tools, which a caller could plausibly confuse it with.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives post-call guidance ("save the returned slug and use it in prompts/configs") which implies the intended workflow, but it never says when to choose this over create_api_key or when to use secret_mappings instead of passing a raw key. Usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server