Which Agent Router credential buys what

Three different Router credentials appear in the Secret, and they are not interchangeable. Setting the wrong one buys a capability you did not want and leaves the one you did want unconfigured.

What you want	Chart value	Secret key	Read by
Chat — the mandatory one	secrets.inferenceKey	tare-inference-key	the agent runner, directly, for every user
Chat, with per-user cost attribution	secrets.tarePlatformApiKey	tare-platform-api-key	the agent runner, to mint a key per user. Needs an admin key.
Router spend (indexed or live) and directory=live	secrets.valetApiKey	valet-api-key	the management MCP, and the nightly spend sweep. Insights reads need admin.

Set exactly one of the first two. They are two answers to the same question — where the runner gets an inference credential — and the chart refuses to render with neither. secrets.inferenceKey is the one to want wherever your process forbids an application minting keys, or where no admin key is available; Prism then never mints, and nothing bypasses your key issuance process. What you give up is a per-Prism-user split of LLM cost, which is immaterial for a pilot audience and does not affect any of the per-developer analysis Prism shows — that comes from the data sources, not from who called the model.

The third is separate from both. valet-api-key is what the management MCP and the spend sweep authenticate with, and no amount of tarePlatformApiKey populates it. This is worth stating plainly because the two are easy to conflate: they may even be the same key value on your Router, but they are different keys in the Secret, read by different components, and only one of them turns spend on.

One related setting: router.keyMode (auto, byok, mint) tells the self test which of the first two this install holds, so its management api line knows whether minting is a hop this deployment even takes. auto reads it off the credential the chart renders and is right whenever the chart owns the Secret; with existingSecret the chart can see neither key, so say byok or mint explicitly to get a definite verdict rather than a softened warning.