Bifrost Virtual Key

Description

General

• Documentation: https://docs.getbifrost.ai/features/governance/virtual-keys
• Summary: Bifrost is an open-source LLM gateway by Maxim AI that exposes a unified, OpenAI-compatible API in front of upstream model providers such as OpenAI, Anthropic, Google and AWS Bedrock. Virtual keys are the credentials that applications present to a Bifrost deployment, in the x-bf-vk, Authorization: Bearer, x-api-key, x-goog-api-key or api-key header. Each key carries its own provider and model permissions, budget and rate limits, so a leaked key grants access to the gateway's model spending on behalf of its owner. This detector matches the virtual key either on its own or together with the URL of the Bifrost deployment it belongs to.

Revoke the secret

A virtual key can be deactivated or deleted from the Governance section of the Bifrost web UI, or through the management API by deleting the key (DELETE /api/governance/virtual-keys/{vk_id}) or rotating its value, which replaces the leaked value with a new one.

Details for Bifrost Virtual Key

• Family: token

• Category: ai

• Company: Maxim AI

• High recall: True

• Validity check available: True

• Analyzer available: False

• Revoker available: False

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Occurrences found for one million commits: 0.1

• Prefixed: True