portkey-admin-mcp

create_virtual_key

Store a provider API key as a virtual key with optional usage and rate limits, then use the returned slug in prompts and configs.

Instructions

Store a provider API key as a virtual key. The raw key is encrypted and only returned at creation time, so save the returned slug and use it in prompts/configs. Optional usage and rate limits apply immediately, and the tool returns the new slug.

Input Schema

TableJSON Schema

Name	Required	Description
`key`	No	Provider API key; omit when secret_mappings supplies key
`name`	Yes	Display name for the virtual key
`note`	No	Optional note or description for this key
`provider`	Yes	Provider slug (e.g., 'openai', 'anthropic', 'azure-openai', 'google')
`expires_at`	No	Expiration in ISO 8601 format
`api_version`	No	API version (for Azure OpenAI)
`credit_limit`	No	Maximum usage cost threshold
`workspace_id`	No	Workspace ID to create the key in
`resource_name`	No	Resource name (for Azure OpenAI)
`rate_limit_rpm`	No	Requests per minute limit
`alert_threshold`	No	Percentage of credit_limit at which to send alert emails (0-100)
`deployment_name`	No	Deployment name (for Azure OpenAI)
`secret_mappings`	No	Secret Reference mappings for key or model_config fields
`deployment_configurations`	No	Azure deployment configurations with API versions and aliases

Output Schema

TableJSON Schema

Name	Required	Description
`ok`	Yes	Whether the tool call succeeded and returned structured data
`data`	No	Structured success payload when ok is true
`error`	No	Structured error payload when ok is false

Schema Changelog

Changes observed during successful MCP inspections.

Changed3 schema fields changedv0.12.2Oct 2, 2026

changedInput schema / properties / expires_at / pattern

Previous value: -"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"New value: +"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"

removedInput schema / properties / secret_mappings / items / properties / secret_key / anyOf
```
Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]
```
addedInput schema / properties / secret_mappings / items / properties / secret_key / type
```
Added value: +[
+  "string",
+  "null"
+]
```

Changed5 schema fields changedv0.11.5Sep 8, 2026

addedInput schema / properties / deployment_configurations

Added value: +{
+  "description": "Azure deployment configurations with API versions and aliases",
+  "items": {
+    "properties": {
+      "alias": {
+        "description": "Optional model alias for the deployment",
+        "type": "string"
+      },
+      "api_version": {
+        "description": "Azure OpenAI API version",
+        "minLength": 1,
+        "type": "string"
+      },
+      "deployment_name": {
+        "description": "Azure deployment name",
+        "minLength": 1,
+        "type": "string"
+      },
+      "is_default": {
+        "description": "Whether this is the default Azure deployment",
+        "type": "boolean"
+      }
+    },
+    "required": [
+      "api_version",
+      "deployment_name"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

addedInput schema / properties / expires_at

Added value: +{
+  "description": "Expiration in ISO 8601 format",
+  "format": "date-time",
+  "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+  "type": "string"
+}

changedInput schema / properties / key / description

Previous value: -"The actual provider API key to store"New value: +"Provider API key; omit when secret_mappings supplies key"

addedInput schema / properties / secret_mappings

Added value: +{
+  "description": "Secret Reference mappings for key or model_config fields",
+  "items": {
+    "properties": {
+      "secret_key": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "Optional key selected from a structured external secret"
+      },
+      "secret_reference_id": {
+        "description": "Secret Reference ID that owns the external secret",
+        "type": "string"
+      },
+      "target_field": {
+        "description": "Virtual Key field populated from the Secret Reference",
+        "type": "string"
+      },
+      "value_format": {
+        "anyOf": [
+          {
+            "enum": [
+              "json",
+              "string"
+            ],
+            "type": "string"
+          },
+          {
+            "type": "null"
+          }
+        ],
+        "description": "Whether Portkey reads the mapped value as JSON or a string"
+      }
+    },
+    "required": [
+      "target_field",
+      "secret_reference_id"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

changedInput schema / required

Previous value: -[
-  "name",
-  "provider",
-  "key"
-]New value: +[
+  "name",
+  "provider"
+]

Addedv1.0.1May 7, 2026
RemovedMay 1, 2026
First observedJan 1, 2026

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-readonly, non-destructive, non-idempotent, openWorld. The description adds real value beyond that: the raw key is encrypted and returned only at creation time, limits apply immediately, and it returns the new slug. It omits the key/secret_mappings interaction, which the schema covers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the core action and the critical caveat about saving the returned key. Minimal waste, though the final 'returns the new slug' clause is slightly redundant with the earlier mention.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return details need not be explained. For a 14-parameter tool the description covers the essential behavioral and lifecycle facts; the main gaps are the alternative-tool routing and the key-vs-secret_mappings dependency.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 14 parameters, including the key/secret_mappings conditional. The description adds essentially no parameter-level meaning, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Store a provider API key as a virtual key.' It's clear what the tool does. It doesn't explicitly differentiate from the sibling create_api_key or update_virtual_key, so it falls short of 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides implied usage ('use it in prompts/configs') but never states when to choose this over create_api_key or update_virtual_key, nor any prerequisites. Context is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server