***

title: Provider & Virtual Keys
description: Understand the difference between Master Keys and Virtual Keys
---------------------

For clean Markdown of any page, append .md to the page URL. For a complete documentation index, see https://api.alephant.io/docs/overview/core-concepts/llms.txt. For full documentation content, see https://api.alephant.io/docs/overview/core-concepts/llms-full.txt.

Alephant operates on a dual-key architecture, ensuring security and granular cost tracking.

## Provider Keys (Master Keys)

**Provider Keys** are your raw, Bring-Your-Own-Key (BYO-KEY) credentials from providers like OpenAI, Anthropic, or Azure.

* They are securely encrypted at rest (AES-256).
* End users never see these keys.
* You can map multiple Virtual Keys to a single Provider Key.

## Virtual Keys (VKs)

**Virtual Keys** are proxy credentials generated by Alephant.

* **The Sole Billing Axis:** All usage metering, billing, and budget limits in Alephant are tied to Virtual Keys.
* **Bound to Entities:** A VK is either bound to an **Agent** or a **Member**.
* **Independent Controls:** Each VK can have its own budget. If a VK exceeds its limit, it can be configured to alert administrators or automatically block further requests.

### Virtual Key Expansion

Each subscription tier includes a base number of VKs. If you need more, you can purchase **VK Expansions** via the billing dashboard (available on Pro and higher).