Skip to main content
Workflow llm_call steps and platform agents resolve models through the Providers catalog. Add your vendor API keys so runs use your accounts and billing. Open Providers in the Console at /providers.

​
Console walkthrough

The Providers page shows two tiers of keys: Workspace keys are stored in Vault. After saving, you can reveal or rotate secrets from the same card. Workflow llm_call steps resolve models against this catalog — in Workflow Studio, drag LLM Call from the palette, then pick Model and Source in the node General tab; the compiled step stores model_ref and optional credential fields.
LLM API keys on Providers are different from Settings → API keys (PATs for REST automation). Do not paste LLM vendor keys into the API keys tab.

​
Add a provider key

1

Open Providers

Go to Providers in the sidebar (/providers).
2

Select a vendor

In Workspace keys, choose your LLM provider — OpenAI, Anthropic, Google, and others supported in the catalog.
3

Enter your API key

Paste the key from your vendor dashboard. Keys are stored encrypted in Vault and scoped to your workspace.
4

Save and verify

Save the key, then confirm models for that provider appear in the catalog. In Workflow Studio, add an LLM Call node and select a model (for example GPT-4o) and key source in the node config.
5

Optional: per-step override

In an LLM step’s config, you can bind a specific workspace key instead of the platform default. If loading keys fails, save the workflow and recheck Providers.

​
System vs tenant keys

AgentRuntime may provide system-level keys for trials or specific plans. Tenant keys take precedence when configured — your workflows bill against your vendor account for those models. Check Settings → Usage & History and Analytics (/analytics, when enabled) for credit consumption per model and action type.

​
Using models in workflows

In Workflow Studio, add an LLM Call node (builtin llm_call). Configure in the node panel: The saved graph compiles to an llm_call step with model_ref (for example direct.openai.gpt-4o) and optional llm_credential_id / llm_credential_scope. Runtime resolves vendor, wire model, and API key via the Providers catalog.

​
Resolution order

When a run executes an LLM step:
  1. Match model ID to catalog entry
  2. Use tenant provider key if configured
  3. Fall back to system key if available for your plan
  4. Fail the step with a clear error if no key resolves
Missing or expired API keys cause LLM steps to fail at runtime. Validate with a dry-run where possible, then run a short test workflow after adding keys.

​
Security

  • Rotate keys in Providers before revoking them in the vendor dashboard
  • Restrict provider management to project contributors and admins
  • Do not embed API keys in workflow graphs or Lua scripts — always use the Providers catalog