Providers & API keys

Providers are the configured AI backends (Azure, Bedrock, Gemini, Ollama, OpenAI, Anthropic, Mistral AI, Moonshot AI (Kimi), Z.ai (GLM), DeepSeek, OpenAI-compatible, realtime, knowledge-base backends). API keys let applications call AI endpoints without a user JWT.

Providers (Admin)

Open Studio → Providers.

1. Create a provider: choose type, endpoint/deployment, credentials, and capability flags (text, image, document, audio, embeddings, agent tools, realtime).
2. Discover models when the type supports it; pick defaults used by Playground and agents.
3. Enable/disable or set default without deleting the row.
4. For Internal RAG, enable embeddings on an Azure or Gemini provider, then create knowledge bases that reference that embedding provider.

Prefer selecting a specific provider instance in the UI (and providerId in the API) so routing and cost attribution stay deterministic.

OpenAI-protocol gateways

OpenAI, Mistral AI, Moonshot AI (Kimi), Z.ai (GLM) and DeepSeek all speak the OpenAI chat/completions protocol, so their forms are identical: an API key, an optional base URL and a model. Leave the base URL blank to use the vendor's own host:

Provider type	Default base URL
OpenAI	https://api.openai.com/v1
Mistral AI	https://api.mistral.ai/v1
Moonshot AI (Kimi)	https://api.moonshot.ai/v1
Z.ai (GLM)	https://api.z.ai/api/paas/v4
DeepSeek	https://api.deepseek.com/v1

Set the base URL explicitly for a regional platform — Moonshot's mainland-China endpoint (https://api.moonshot.cn/v1) or BigModel/Zhipu for GLM (https://open.bigmodel.cn/api/paas/v4) — or for a gateway that fronts these models. Discover models works for all of them with the key alone, and streaming, tool calling and agent sessions behave as they do for OpenAI.

Costs are not pre-filled for these vendors: the built-in catalog supplies capabilities and context windows only, so enter per-token prices from the vendor's rate card (linked in the form) if you want cost tracking.

Pick the generic OpenAI Compatible type instead when the server is your own — vLLM, LM Studio, llama.cpp — or a gateway with no first-class entry; it requires a base URL and treats the key as optional.

API keys

Keys are created from auth APIs or project flows (admin / authorized users):

1. Create a key scoped to a project when possible.
2. Copy the secret once — it is not shown again.
3. Clients send x-api-key: <secret> on /api/ai/*, or Authorization: Bearer <api-key> on /v1/*.

Important: Native /api/ai/* routes accept API key only, not JWT.

Security checklist

• Store keys in a secrets manager or environment variables — never in git.
• Use separate keys for development and production.
• Rotate on compromise; revoke unused keys.
• Never put keys in URL query strings except for constrained WebSocket clients that cannot set headers.