API Keys and Endpoints

This page explains how to store your LLM provider API keys as Kubernetes secrets and how to configure custom API endpoints. Complete these steps before enabling LLM-powered analysis in your Repository CR.

Setting Up API Keys

OpenAI

1. Get an API key from OpenAI Platform

2. Create a Kubernetes secret:

kubectl create secret generic openai-api-key \
  --from-literal=token="sk-your-openai-api-key" \
  -n <namespace>

Google Gemini

1. Get an API key from Google AI Studio

2. Create a Kubernetes secret:

kubectl create secret generic gemini-api-key \
  --from-literal=token="your-gemini-api-key" \
  -n <namespace>

Using Custom API Endpoints

By default, Pipelines-as-Code sends requests to each LLM provider’s public API. The api_url field lets you override the endpoint, which is useful when you run:

• Self-hosted LLM services (for example, LocalAI, vLLM, or Ollama with an OpenAI adapter)
• Enterprise proxy services
• Regional or custom endpoints (for example, Azure OpenAI)
• Alternative OpenAI-compatible APIs

Example Configuration

settings:
  ai:
    enabled: true
    provider: "openai"
    api_url: "https://custom-llm.example.com/v1"  # Custom endpoint
    secret_ref:
      name: "custom-api-key"
      key: "token"
    roles:
      - name: "failure-analysis"
        prompt: "Analyze this pipeline failure..."
        output: "pr-comment"

Default API Endpoints

If you do not specify api_url, Pipelines-as-Code uses these defaults:

• OpenAI: https://api.openai.com/v1
• Gemini: https://generativelanguage.googleapis.com/v1beta

URL Format Requirements

The api_url value must:

• Use an http:// or https:// scheme
• Include a valid hostname
• Optionally include port and path components

The following examples show valid and invalid formats:

# Valid URLs
api_url: "https://api.openai.com/v1"
api_url: "http://localhost:8080/v1"
api_url: "https://custom-proxy.company.com:9000/openai/v1"

# Invalid URLs
api_url: "ftp://example.com"       # Wrong scheme
api_url: "//example.com"           # Missing scheme
api_url: "not-a-url"               # Invalid format

Complete Configuration Example

For a full configuration with multiple roles, see the complete example in the Pipelines-as-Code repository.