LLM configuration

Configure your org’s provider, model, keys, and policy under Admin → Agent LLM.

An org admin configures how agents reach their models under Admin → Agent LLM. Until an LLM is configured, tasks can’t be dispatched.

Admin → Agent LLM — provider, model, endpoint, and write-only keys.

This panel is org-admin only, and all API keys are write-only — you set them, and the UI only ever shows whether a key is configured, never its value. Keys are encrypted at rest.

Provider & model

1. Pick a provider

   Anthropic API, Internal gateway, AWS Bedrock, Google Vertex AI, or Azure AI (see Claude Code for what each means).

2. Set the model

   A free-text field with per-provider suggestions. It’s free-text because Bedrock/Vertex take inference-profile IDs or ARNs — enter exactly what your backend exposes. Provider and model must be set together.

3. Add a key (Anthropic / gateway only)

   Bedrock, Vertex, and Azure authenticate via cloud identity and store no key.

Per-agent keys

Codex and Gemini use their own keys:

• OpenAI key (Codex) — needed only if you enable Codex.
• Google key (Gemini) — needed only if you enable Gemini.

Both are write-only and encrypted. You can also set an optional custom endpoint and model per agent (e.g. an OpenAI-compatible gateway).

Org policy

The policy section governs what users may do:

Policy	What it controls
Provider policy	open, or gateway_only to force every task through the internal gateway
Allowed providers	Restrict which providers a task may use
Model allowlists	Per-agent (Claude / Codex / Gemini) — with 2+, users get a Model dropdown
Agent allowlist	Which CLIs (Claude / Codex / Gemini / Kiro) users may launch
Gateway auth	stored_key (encrypted org key) or sso_brokered (short-lived per-task credential from SSO)
Web IDE	Enable the premium Web IDE for tasks

With gateway_only, any attempt to save or run a non-gateway provider is rejected. This is enforced both in the UI and server-side (and backstopped by a database constraint).

Common pitfalls

• No LLM configured → “Tasks can’t be dispatched until one is set.”
• Provider without a model (or vice-versa) → they must be set together.
• Gateway base URL with a trailing /v1 → see Internal gateway.