operate

Credential leases

Understand how Kestrel One grants short-lived access to one approved organization model without exposing provider secrets.

Operationsadvanced0.7.0 Stable
Verified 2026-07-13View sourceReport a docs issue

A credential lease is a short-lived server-side grant that allows one organization to use one approved model through one provider gateway. Members select a model; their browsers never receive the provider credential.

Checks before a lease is issued

  • The person belongs to the active organization.
  • The gateway is available to that organization.
  • The requested model belongs to the gateway and is approved.
  • A managed gateway still has a ready deployment.
  • The lease is scoped to that organization, gateway, and model and expires quickly.

Lease caches include organization identity. Two organizations requesting the same model do not share a credential grant.

Investigate a denied model request

Confirm the organization, gateway visibility, model approval, deployment readiness, and lease issuance in that order. Do not work around a denial by sending a raw provider credential to the browser or silently selecting another model.