Credential Custody and Key Source Routing
In Nimi, all third-party cloud model provider API keys and credentials are maintained securely by Runtime in protected local storage. Applications refer to cloud services using safe symbolic references (connectorRef), eliminating the risk of hardcoding or transmitting plaintext secrets in client-side code.
End-to-End Credential Routing Pipeline
- Session Authentication: When an app dispatches an inference request, Runtime verifies caller identity and authorized capability scopes via the host session.
- Connector Resolution: Using the
connectorRefdeclared in the active AIConfig, Runtime resolves the associated credentials from protected local storage. - Driver Encapsulation: Runtime's provider driver encapsulates prompts and credentials into the provider's native wire format and handles TLS transmission.
- Scrubbing and Response Delivery: Upon receiving the response, provider-proprietary headers, authentication tokens, and internal routing metadata are stripped, returning clean content streams to the client application.
This brokered routing pattern keeps user credentials secure while allowing applications to switch between upstream model providers without code changes.
Configuration and Troubleshooting
- Configuration Workflow: Users enter and update API keys under "Cloud Services" in Nimi Home. In application AI settings, developers or users simply select the desired connector from the dropdown list.
- Credential Rotation: If a key expires or requires replacement, updating the connector under Cloud Services lets later admitted requests use the new credential without changing each App’s connector reference. Existing Jobs retain their captured execution context.