AI Provider Key Settings
Register your own LLM provider keys and manage the model, response options, monthly budget, and endpoint used by the AI Assistant.
Supported providers
You can register multiple keys for the same provider and configure a separate model and options for each key.
| Provider | API key | Endpoint |
|---|---|---|
| OpenAI | Required | Default or custom |
| Anthropic | Required | Default or custom |
| Google Gemini | Required | Default or custom |
| Ollama | Optional | Default or custom |
Registering a provider key
Add a key from the AI Provider API Keys screen.
Open AI Settings
Open My Page from the user menu in the top right, then select AI Settings.
Add a key
Select Add First Provider or Add Key, then choose a provider. Add a label if you need to distinguish multiple keys for the same provider.
Verify the API key and model
Enter an API key issued by the provider and, when needed, a custom endpoint. Load models from the provider catalog or that endpoint, then choose the default model for this key. Depending on your configuration, an API key can be omitted for Ollama.
Configure options and save
Set Max output tokens, a monthly budget, and a private endpoint when needed, then save the key.
Note: The first key automatically becomes the primary provider key. The star on a card changes which key Chat selects first, while the default model in key settings determines the model used with that key.
Per-key options
Manage the following values separately for each registered key.
| Option | Description |
|---|---|
| Label | A name used to distinguish multiple keys for the same provider. |
| Default model | The chat model called when this key is selected. |
| Max output tokens | The maximum number of tokens in one response. If it is too small, an explanation or SQL can be cut off. |
| Monthly budget (USD) | A budget used to restrict additional calls based on the recorded estimated spend for the current month. Leave blank for unlimited. |
| Private endpoint | Enter a custom API base URL for an internal AI gateway, proxy, or local Ollama instead of the provider default. |
For NL2SQL, Query Tuning, and Sample Data generation, start with Max output tokens 4096.
Caution: Token counts and costs shown in NeoSQL are estimates; provider billing is authoritative. The monthly budget checks recorded spend when a call starts, so it is not a guaranteed hard cap across concurrent requests.
Managing keys
After registration, use each key card to manage its default selection, availability, credentials, and usage.
- Primary provider key: mark it with the star to select it first in new Chat sessions. This is separate from the default model configured for each key.
- Enable or disable: a disabled key cannot be used for new AI requests.
- Replace credentials: save a new API key and custom endpoint from the edit screen to rotate connection credentials.
- Delete: when multiple keys exist, the primary provider key cannot be deleted directly. Make another key primary first. When only one key exists, it can be deleted.
- Usage and budget: review recent usage and estimated spend for the current month, then adjust the per-key monthly budget.
Key protection and endpoint policy
Provider keys and custom endpoints are managed per account, and endpoint availability depends on the execution environment.
- API keys and custom endpoints are stored using AWS KMS Envelope Encryption and AES-256-GCM.
- The saved key value is never shown again in settings; only a masked value is returned.
- A key belongs only to the user who registered it and is not shared with project members.
| Environment | Endpoint policy |
|---|---|
| Web App | Endpoints must use HTTPS. Localhost and literal private or special-purpose IP addresses are blocked for execution and model lookup. |
| Desktop Online | Public endpoints plus allowed HTTP, localhost, and private-IP endpoints can be used for local or internal providers. |
Troubleshooting
If you cannot send a message or load models after saving a key, check the following items.
- The Send button is unavailable when there is no usable key. Make sure the key is enabled.
- For provider authentication errors, check whether the API key is expired or missing required permissions.
- If the model list is empty, check whether lookup uses the provider catalog or a custom endpoint, verify the API key and endpoint, then run model search again.
- For ENDPOINT_NOT_ALLOWED, check whether a local, HTTP, or private-IP endpoint is being used from the Web App.
- For BUDGET_EXCEEDED, review the key's estimated current-month spend and monthly budget.