[roh26it]

Summary

• Adds section 6, "Plugin integration credentials", to the rotation guide in both support/ and aigw/support/.
• Covers rotating guardrail and tool plugin credentials (Lasso, Pangea, Aporia, Pillar, Prisma AIRS, F5, Azure, Bedrock, Tavily, Exa) under Settings > Integrations, and updating workspace-level Override Credentials on guardrails.
• Renumbers later sections and updates the overview table, anchors, and checklist.

For reviewers

• The per-plugin credential table covers the plugins whose docs state their credential type; other plugins fall under "API-key plugins".
• Override Credentials are documented for Prisma AIRS and F5 only; other plugins may support them too.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
portkey-docs	🟢 Ready	View Preview	Nov 12, 2026, 11:41 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[Copilot]

🟡 Changes recommended

The guide omits plugin-specific settings locations and the trust-policy update sequence needed to prevent AssumeRole failures during external ID rotation.

2 open issues

• Document plugin-specific credential settings paths · New
• Update the trust policy before rotating the external ID · New

What changed in this PR

Adds plugin credential rotation guidance to the Portkey and AI Gateway documentation, extending the existing rotation workflow to third-party guardrail and tool integrations.

Changes:

• Documents provider credential replacement, workspace overrides, testing, and revocation.
• Adds a per-plugin credential reference table.
• Updates section numbering, anchors, overview tables, and checklists in both guides.

File	Description
support/​rotate-credentials.mdx	Adds plugin credential rotation guidance for Portkey.
aigw/​support/​rotate-credentials.mdx	Mirrors the guidance with AI Gateway wording and links.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The rotation guidance omits plugin-specific navigation routes and coordinated IAM trust-policy updates needed to prevent assumed-role access failures during external ID rotation.

2 open issues

• Update the trust policy before rotating the external ID
• Document plugin-specific credential settings paths

2 previously missed issues

In code that hasn't changed since last review

Document plugin-specific credential locations

aigw/​support/​rotate-credentials.mdx:188

The single navigation path does not cover all plugins in this section. aigw/integrations/plugins/tavily.mdx:28 and aigw/integrations/plugins/exa.mdx:28 put their keys under Settings > Plugins, while aigw/integrations/guardrails/f5-guardrails.mdx:12 uses Admin Settings > Plugins. Include those routes or link to the plugin-specific setup instructions so readers can locate and rotate those credentials.

Document safe external ID rotation in the trust policy

support/​rotate-credentials.mdx:190

For assumed-role setups, changing the external ID only in the integration makes subsequent AssumeRole requests fail because the role's sts:ExternalId condition still expects the old value. Document adding the new ID to the trust policy while retaining the old ID, updating the integration, then removing the old ID after propagation and successful testing. Apply the same change in aigw/support/rotate-credentials.mdx:204.

_{Review effort: Balanced}