Core concepts

Bring your own key

Your provider account, sealed with KMS.

A provider credential is sealed on write under a per-customer encryption context. The wrapping key never leaves the KMS, and the plaintext exists only inside a callback that lasts one request.

Connect a provider key

seams providers connect production --provider openai --key sk-…

# provider   openai
# label      production
# last four  8c21
# status     active

import { Seams } from "@ourseams/sdk"

const seams = new Seams({ apiKey: process.env.SEAMS_API_KEY! })
const account = await seams.providers.connect("production", {
  provider: "openai",
  apiKey: process.env.OPENAI_API_KEY!,
})
// account.label · account.lastFour

import os
from seams import Seams

seams = Seams(api_key=os.environ["SEAMS_API_KEY"])
account = seams.providers.connect(
    "production",
    provider="openai",
    api_key=os.environ["OPENAI_API_KEY"],
)
# account.label · account.last_four

After connect, mint end-user keys as usual. Calls with those ak_ keys use your provider account; you keep the provider bill, and Seams meters and caps the spend.

Probe, rotate, disconnect

A credential is replaced, never read back. Probe checks health; rotate swaps the plaintext behind the same label; rm disconnects.

seams providers probe production
seams providers rotate production --key sk-…
seams providers rm production --yes

await seams.providers.probe("production")
await seams.providers.rotate("production", { apiKey: process.env.OPENAI_API_KEY! })
await seams.providers.rm("production")

seams.providers.probe("production")
seams.providers.rotate("production", api_key=os.environ["OPENAI_API_KEY"])
seams.providers.rm("production")

The resolved cache is in-process and nowhere else: any shared store persists to disk, replicates over a network, and shows up in whatever inspection tool it ships.