Providers
Overview
A Provider is an LLM service registered against your organisation that supplies the model an agent will use at runtime. You register a provider once with its credentials, and from then on any agent in your organisation can pick a model from it.
Providers live under Automation → Custom Agents → Providers.
Supported provider types
| Provider | Provider type ID | Auth | Notes |
|---|---|---|---|
| OpenAI | openai | API key | All chat-capable OpenAI models. Also supports Azure-hosted OpenAI via the same form. |
| Anthropic | anthropic | API key | Claude family via Anthropic's direct API. Streaming is enabled by default to support long max_tokens. |
| Google Gemini | gemini | API key (+ optional Vertex routing) | Gemini chat models. Setting a project ID + region in the form routes the requests through Google Vertex AI. |
| OpenRouter | openrouter | API key | Aggregator — gives you access to a large catalogue of models from a single key. |
| DeepSeek | deepseek | API key | DeepSeek chat (V3) and reasoning (R1) models. |
| AWS Bedrock | bedrock | Bedrock API key OR AWS IAM access key + secret | Multi-vendor catalogue (Claude, Nova, Llama, Mistral, Cohere, AI21 Jamba, Titan, DeepSeek-on-Bedrock, etc.) accessed through a single AWS account. See AWS Bedrock below for the details. |
Adding a provider
- Open Automation → Custom Agents → Providers.
- Click New provider in the top-right of the list.
- Pick a Provider type — the rest of the form adapts to show the fields that provider needs.
- Fill in the form (fields depend on provider type — see the per-provider sections below).
- Click Save provider.
The provider then appears in the providers list and is available to all agents in the organisation.
The form is schema-driven. Every provider type advertises its own list of credential and configuration fields to the frontend. Adding a new provider type in the platform automatically surfaces the right form here — you don't need to wait for a separate UI update.
Per-provider configuration
OpenAI
Credentials
| Field | Required | Description |
|---|---|---|
| API Key | Yes | Your OpenAI secret (sk-…). Stored encrypted; never returned to the browser. |
Configuration
| Field | Required | Description |
|---|---|---|
| Base URL | No | Default is https://api.openai.com/v1. Override only if you're proxying through a gateway. |
| Use Azure OpenAI | No | Tick to route through Azure-hosted OpenAI instead of the public API. Requires the Azure API Version field below. |
| Azure API Version | No (Yes if Azure) | e.g. 2024-08-01-preview. Only relevant when Use Azure OpenAI is on. |
Anthropic
Credentials
| Field | Required | Description |
|---|---|---|
| API Key | Yes | Your Anthropic secret (sk-ant-…). |
Configuration
| Field | Required | Description |
|---|---|---|
| Base URL | No | Default is https://api.anthropic.com. Override for proxies or enterprise setups. |
This is the direct Anthropic path. To use Claude through AWS, register a separate AWS Bedrock provider instead (see below).
Google Gemini
Credentials
| Field | Required | Description |
|---|---|---|
| API Key | Yes | Your Google AI Studio API key. |
Configuration
| Field | Required | Description |
|---|---|---|
| Vertex Project ID | No | Your GCP project ID. Setting this switches the provider to Vertex AI routing. |
| Vertex Region | No | e.g. us-central1. Required when Vertex Project ID is set. |
Leave both Vertex fields empty to use the public Gemini Developer API with the API key. Filling them in routes through Vertex AI for production workloads (better SLA, regional compliance, etc.).
OpenRouter
Credentials
| Field | Required | Description |
|---|---|---|
| API Key | Yes | Your OpenRouter key (sk-or-…). |
Configuration
| Field | Required | Description |
|---|---|---|
| Base URL | No | Default is https://openrouter.ai/api/v1. |
DeepSeek
Credentials
| Field | Required | Description |
|---|---|---|
| API Key | Yes | Your DeepSeek API key. |
Configuration
| Field | Required | Description |
|---|---|---|
| Base URL | No | Default is https://api.deepseek.com. |
AWS Bedrock
AWS Bedrock is a managed catalogue of LLMs from multiple vendors (Anthropic, Amazon, Meta, Mistral, Cohere, AI21, DeepSeek, Writer, Qwen, OpenAI gpt-oss). One Bedrock provider gives an agent access to all the models your AWS account has access to in the configured region.
Authentication — two modes, pick one:
Mode 1 — Bedrock API key (recommended for onboarding)
A bearer token you generate in the AWS console. Simplest to set up.
| Field | Required | Description |
|---|---|---|
| Bedrock API Key | Yes | Bearer token from AWS Console → Bedrock → API keys. Long-term keys are designed for exploration; short-term keys are tied to a console session and auto-expire (typically 12 h). |
Mode 2 — AWS IAM credentials
Standard AWS access key + secret. Production-grade, governed by your org's IAM policies.
| Field | Required | Description |
|---|---|---|
| AWS Access Key ID | Yes | AKIA… |
| AWS Secret Access Key | Yes | The matching secret. |
| AWS Session Token | No | Only relevant for temporary STS credentials (e.g. from AssumeRole). |
Pick one mode — don't fill in both. The form's authentication picker enforces this.
Configuration
| Field | Required | Description |
|---|---|---|
| AWS Region | Yes | e.g. us-east-1, eu-west-3, ap-southeast-2. Bedrock model availability and cross-region inference profiles are scoped to a region family. |
| Custom Endpoint URL | No | For VPC endpoints or test setups. Leave blank for the standard bedrock-runtime.<region>.amazonaws.com. |
Required IAM permissions
Whichever auth mode you pick, the credentials need at least:
bedrock:InvokeModelbedrock:InvokeModelWithResponseStreambedrock:ListFoundationModelsbedrock:ListInferenceProfiles
The AmazonBedrockLimitedAccess AWS-managed policy is a convenient
starting point.
Anthropic models — additional gate
If you plan to use any Claude model on Bedrock, you must also submit the Anthropic use-case details form in the AWS console (Bedrock → Model access → Anthropic). Without it, Claude invocations return:
ResourceNotFoundException: Model use case details have not been
submitted for this account. Fill out the Anthropic use case details
form before using the model.
The form is per AWS account, not per provider. Other vendors (Amazon Nova, Meta Llama, Mistral, Cohere) don't have this gate.
Region scoping and the model dropdown
The Bedrock catalogue is region-specific. A provider configured for
eu-west-3 shows EU models (eu.anthropic.claude-3-…,
eu.amazon.nova-…); a provider for us-east-1 shows US models. If
the live ListFoundationModels call fails, the dropdown falls back
to a curated static list that respects the configured region family
(US, EU, or APAC).
Model behaviour quirks the platform handles automatically
The platform routes between streaming and non-streaming Converse calls based on what each Bedrock model actually supports. You don't need to care unless you're debugging an agent run:
| Model family | Behaviour |
|---|---|
| Anthropic Claude 3+/4 | Full streaming, including with tools. Streamed token-by-token. |
| Amazon Nova Pro / Lite / Micro / Premier / 2-Lite | Full streaming, including with tools. |
| Cohere Command R / R+ | Full streaming, including with tools. |
| DeepSeek V3 | Full streaming, including with tools. |
Qwen 3, OpenAI gpt-oss, AI21 Jamba 1.5 | Full streaming, including with tools. |
| Meta Llama (all versions) | Streams alone, but not when tools are bound. The platform routes these via non-streaming Converse when an agent has tools, returning the full response at once instead of incrementally. |
| Mistral (all versions) | Same — non-streaming when tools are bound. |
| Cohere Command (non-R) | Same — non-streaming when tools are bound. |
| DeepSeek R1 | Same — non-streaming when tools are bound. |
| AI21 Jamba-Instruct, Amazon Titan Text, Writer Palmyra | Same — non-streaming when tools are bound. |
| Anthropic Claude v2 / Instant (legacy) | Same — non-streaming when tools are bound. |
| Amazon Titan Embeddings, Cohere Embed, image-gen models | Not selectable as agent brains (no tool use). |
The classification is ported from the LangChain langchain-aws
project, which maintains the canonical capability matrix. New models
inherit "full streaming" by default; if you pick one and it errors,
the error surfaces honestly — pick a different model.
Tool-use reliability
A separate dimension from streaming: how reliably does a Bedrock model
actually emit structured tool calls when given tools? Bedrock's
Converse API expects models to return toolUse content blocks; the
agent runner only invokes a tool when it sees one. Some models
inconsistently fall back to ReAct-style text ("Action: http_request
\nParameters: …") that describes a tool call instead of making one.
Reliable tool callers — recommended for agents:
| Family | Behaviour |
|---|---|
| Anthropic Claude 3+/4 (any variant) | Structured tool calls every time. |
| Amazon Nova Pro / Lite / Premier / 2-Lite | Structured tool calls every time. |
| Cohere Command R / R+ | Structured tool calls every time. |
| DeepSeek V3 | Structured tool calls every time. |
OpenAI gpt-oss | Structured tool calls every time. |
Known inconsistent — usable for chat but flaky as agent brains:
| Family | Behaviour |
|---|---|
| Mistral Large 2402 / 2407 | Often emits "Action: tool_name…" as text instead of a toolUse block, especially when many tools are configured or the system prompt is dense. Runs end up looping and hitting the "agent did not call write_output_file" nudge limit. |
| Mistral Small / Mistral 7B / Mixtral | Same pattern, worse — these tend to ReAct-prose more often than not. |
| Meta Llama 3.x (smaller variants) | Mixed; the 8B and 1B/3B models in particular often fall back to prose. Llama 3.3 70B and Llama 4 are more reliable but still less consistent than Claude/Nova. |
Rule of thumb. If you're building an agent that calls tools, start with Claude Haiku 4.5 or Amazon Nova Lite — both are cheap, fast, and emit structured tool calls every single time. Move to a larger model (Claude Sonnet, Nova Pro) when you need more reasoning depth. Use Mistral / Llama Bedrock variants for chat-style agents with no tools, or accept the run-failure rate as part of the trade-off.
When an unreliable model loops without calling tools, you'll see it
in the execution timeline as repeated "Thinking" events describing
tool calls in prose, followed by agent execution failed: agent did not call write_output_file successfully after 2 nudges. Switching
to a Claude or Nova model resolves it immediately.
Editing a provider
Click a provider's row to open its detail page, then make changes:
- Provider name can be changed at any time.
- Provider type is fixed once a provider is created. To switch vendors, create a new provider and update your agents to point at it.
- Credentials (API key, AWS keys, etc.) must be re-entered to be replaced. Leaving every credential field blank means "no change" — the existing encrypted credentials are kept. Filling in some but not all required fields for the active auth mode is rejected to prevent half-rotated key pairs.
- Configuration fields (base URL, region, Azure/Vertex toggles, etc.) can be updated at any time.
Models
You don't register models manually. After a provider is saved, the platform automatically fetches the catalogue of models that key has access to and exposes them in the Agent form's model dropdown. The model list is keyed off the provider, so each provider in your org can expose a different catalogue.
When the catalogue can't be fetched live (provider API outage, rate-limiting, network blip, missing IAM permission), the agent form falls back to a cached list and shows a hint: "Models loaded from cache — provider API may be unavailable." You can still pick a model and save the agent; if the model id is valid for that provider/region, the agent will run normally.
Deleting a provider
Click a provider's row to open its detail page, then click Delete.
A provider cannot be deleted while one or more agents reference it — the delete will return an error listing the agents you need to reassign or delete first.
Credential handling
| What you provide | Where it goes |
|---|---|
| A new credential field on create | Encrypted (AES-256-GCM) and stored against this provider. |
| Every credential field blank on edit | The existing credentials are kept. |
| At least one credential field filled on edit | Every required credential for the active auth mode must also be filled. The encrypted blob is fully replaced. |
Credentials are never returned to the browser after they're saved. The edit form always shows empty credential fields, regardless of whether values are stored.
Best practices
- One provider, many agents. Register a provider once per vendor
- account and reuse it across agents. There's no benefit to creating multiple rows for the same vendor unless you want to scope them to different budgets or rate limits.
- Name them by purpose, not by vendor. A name like "R&D Anthropic (high quota)" tells your team more than "Anthropic".
- Rotate credentials via the edit form. Generate a new key on the vendor's dashboard, paste it into the provider edit form, save — the old credentials stop being used immediately.
- Test with a cheap model first. When verifying a provider works, pair it with a cheap model (Haiku, Nova Lite, DeepSeek V3, GPT-4o Mini) in a throwaway agent before binding it to production workflows.
- For AWS Bedrock: prefer IAM credentials in production over long-term Bedrock API keys. Long-term API keys are useful for initial onboarding, but AWS recommends short-term IAM-derived credentials for production.
Troubleshooting
| Issue | Resolution |
|---|---|
| Models dropdown is empty in the agent form | The provider key is rejected by the vendor or the vendor API is down. Check the Models loaded from cache hint and verify the credentials on the vendor's dashboard. |
| "Invalid API key" / "Credentials required" on save | The form rejected the input shape. For Bedrock specifically, make sure you've filled in exactly one auth mode (Bedrock API key OR access_key + secret_key — not both, not neither). |
| Cannot delete a provider | One or more agents still reference it. Edit those agents first or delete them. |
| Edit form does not show the current credentials | Expected. Credentials are write-only — leave every field blank to keep, paste new values to replace. |
| Bedrock — "Model use case details have not been submitted" | An Anthropic model on Bedrock requires the Anthropic use-case details form (AWS Console → Bedrock → Model access). Submit it; AWS approves in minutes. Other vendors don't have this gate. |
| Bedrock — "The provided model identifier is invalid" | Cross-region inference profiles are region-scoped. A us.* model ID won't work in an eu-* region (and vice versa). Pick a model whose prefix matches your provider's configured region. |
| Bedrock — "Access denied" on the model dropdown | The credentials are missing bedrock:ListFoundationModels and/or bedrock:ListInferenceProfiles permissions. Attach the AmazonBedrockLimitedAccess managed policy or equivalent. |
| Bedrock — agent invocation returns "ThrottlingException" | You've hit the Bedrock model's per-account quota. Request a quota increase in the AWS Service Quotas console or switch to a cross-region inference profile (which spreads load across regions). |
Updated: 2026-05-21