> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure provider key failover

> Try another provider key when one hits a rate limit, quota limit, or auth error.

Configure multiple provider keys in an [access key configuration](/ai-gateway/guides/access-key-configurations) routing rule. The gateway tries keys in order when one hits a rate limit, runs out of quota, or fails authentication.

## How failover works

When a routing rule step lists multiple provider keys:

1. The gateway tries the first key.
2. On rate limit (429), auth failure, or certain upstream errors, it tries the next key.
3. If all keys in the step fail, the gateway tries the next step in the rule (if any), or returns an error.

Failover is configured per provider in the access key configuration—not in your application code.

## Via dashboard

1. [Add multiple provider keys](/ai-gateway/guides/attaching-provider-keys#add-a-provider-key) for the same provider.
2. [Edit an access key configuration](/ai-gateway/guides/access-key-configurations#create-a-configuration).
3. Add or edit a routing rule for the provider.
4. Attach multiple keys to the **Bring your own API key** step in the order you want them tried.

## Via the AI Gateway API

```bash theme={null}
curl -X POST https://api.ngrok.ai/access-key-configurations \
  -H "Authorization: Bearer $AI_GATEWAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "OpenAI with failover",
    "router": {
      "rules": [
        {
          "provider": "openai",
          "steps": [
            {
              "type": "user",
              "keySelectionStrategy": "ordered",
              "keys": [
                { "id": "aigpk_primary" },
                { "id": "aigpk_backup" }
              ]
            }
          ]
        }
      ]
    }
  }'
```

See the [Access Key Configurations API reference](/ai-gateway/api-reference/access-key-configurations/create).

Assign the configuration to your access key. Your app sends only the access key:

```python theme={null}
client = OpenAI(
    base_url="https://gateway.ngrok.ai/v1",
    api_key="ng-xxxxx-g1-xxxxx",
)
```

## Next steps

* [Bring your own provider key](/ai-gateway/guides/attaching-provider-keys): Store upstream credentials
* [Access Key Configurations](/ai-gateway/guides/access-key-configurations): Routing rules and scope
* [How It Works](/ai-gateway/how-it-works): Full request flow