Model providers
One provider entry per AI vendor (name, type, API key) held by the platform and resolved by every Agent at run time. Configure it once; no model keys on agents.
A model provider is a named credential for an AI vendor (its name, type, and API key) configured once at the platform level. Agents resolve it at run time, so model keys stay in the platform and never live on individual agents or in their manifests.
Add a provider
In the dashboard: Providers → Add provider. Pick the type, name it, and paste the API key. The Model field can be typed freely or filled with Load from provider, which lists the models your key can actually reach.
The key is write-only: encrypted at rest, never rendered back. Editing with the key field blank keeps the existing key. Validate checks the key against the vendor before you save, so a bad key fails here and not at the first agent run. For a guided first setup, see Create your first Agent.
Provider types
| Type | Notes |
|---|---|
| Anthropic (Claude) | Keys from the Anthropic Console. Used by the ClaudeCode runtime. |
| OpenAI | Keys from the OpenAI platform. Used by the Codex runtime. |
| Google Gemini | Keys from Google AI Studio. Used by the Gemini runtime. |
| OpenRouter | One key across many vendors; models are vendor-prefixed (z-ai/glm-5.2). |
| OpenCode Zen | OpenCode's hosted gateway. GPT, Claude, Gemini, GLM and more behind one key. |
| OpenAI Compatible | Anything speaking the OpenAI wire format: self-hosted vLLM, LiteLLM, Together. Base URL required. |
The tenant default
Set as default provider makes an entry the tenant default: exactly one per tenant, starred in the list, and checking it on another entry moves it. The default is what the agent create dialog pre-selects and what the dashboard's own AI helpers run on. Changing it never touches existing agents; each keeps the provider it was created with until you re-point it.
How Agents resolve providers
Each agent binds one provider entry, chosen at create time and changeable later from the agent detail page (the pod restarts once idle to pick it up). Which entries are eligible depends on the agent's runtime: ClaudeCode wants anthropic, Codex wants openai, Gemini wants gemini, and OpenCode accepts most types or none at all, falling back to its free keyless model.
Restricting a provider
A provider starts open to everyone in the tenant. Add users, teams, or roles to its Access panel and it becomes restricted: hidden from everyone else's lists and pickers. Useful for keeping a production key out of experiments.