# `LLMProxy.Provider.TokenCodec.AESGCM`
[🔗](https://github.com/elixir-vibe/llm_proxy/blob/v0.3.1/lib/llm_proxy/provider/token_codec/aes_gcm.ex#L1)

Versioned AES-256-GCM codec for provider credentials.

Options must contain `:active_key_id` and a `:keys` map. Each key is a
Base64-encoded 32-byte value or an explicit `{:raw, value}` tuple. Encryption
always uses the active key. Decryption selects the key ID from the ciphertext,
so old keys can stay in the map during rotation.

Set `:allow_plaintext` to `false` after an explicit migration is verified.

---

*Consult [api-reference.md](api-reference.md) for complete listing*