LLM Keys
Deployment.io's agents — the ones that run Tasks and Assistant sessions — call an LLM on your vendor account. You add the key once per organization, and every agent run from then on uses it. Usage is billed by Anthropic or OpenAI directly; Deployment.io doesn't resell tokens.
This is separate from connecting your own coding agent over MCP. If you're pointing Claude Code or Cursor at Deployment.io from your laptop, that agent uses whatever credentials it already has — see MCP Configuration instead.
Where to find it
Organization Settings → Agents → LLM Keys (https://app.deployment.io/org-settings/agents).
The page has two independent sections:
| Section | Credential | Used by |
|---|---|---|
| Claude | Anthropic API key | The Claude Code agent |
| Codex | OpenAI API key | The Codex agent |
Each section has its own input and its own Save button — saving one never touches the other. You only need a key for the agent you actually use.
Tasks are blocked until a key is configured. Creating a Task requires the organization to have at least one usable agent credential. If you haven't added one, Task creation is refused.
Adding an Anthropic key
- Create a key at platform.claude.com/settings/keys. Copy it — Anthropic only shows it once.
- In the dashboard, go to Organization Settings → Agents → LLM Keys.
- In the Claude section, paste the key into the API key field. It starts with
sk-ant-api03-. - Optionally click the eye icon to unmask the field and confirm you pasted the whole key.
- Click Save Claude key.
You'll get a "Claude credentials saved" confirmation, and the field collapses to a masked display.
Adding an OpenAI key
- Create a key at platform.openai.com/api-keys.
- In the Codex section, paste the key into the API key field. It starts with
sk-. - Click Save OpenAI key.
Rotating a key
Once a key is saved, the section shows it masked — the first few and last few characters only, with the middle redacted. The plaintext is never returned to the browser again.
To rotate:
- Click Replace next to the masked key.
- Paste the new key into the New API key field.
- Click Save Claude key / Save OpenAI key.
The existing key stays active until the new one is saved, so there's no window where agents are left without a credential. Click Cancel to back out without changing anything.
How keys are stored
- Encrypted at rest. Keys are encrypted with AES-GCM before they're written to the database. They are never stored in plaintext.
- Never re-displayed. After you save, the dashboard and the API only ever return a masked form of the key.
- Decrypted only at run time. When an agent job starts, the key is decrypted and passed to the sandboxed agent container running on your runner.
Validation
Both fields apply the same sanity checks before anything is saved:
| Condition | Result |
|---|---|
| Empty | "API key is required" — the Save button stays disabled |
| Fewer than 20 characters | "API key looks too short — double-check the value you pasted" |
| More than 500 characters | Rejected — check that you pasted only the key, not surrounding text |
These catch truncated or mis-pasted values. They don't verify the key against the vendor, so a well-formed but revoked key will save successfully and fail later at run time.
Troubleshooting
- "API key looks too short" — you probably copied a partial value. Anthropic console keys are around 100 characters. Re-copy the whole key.
- A Task fails with an authentication error — the saved key may have been revoked or may have hit a spend limit at the vendor. Check the key's status in the Anthropic or OpenAI console, then rotate it here using Replace.
- You can't create a Task at all — no agent credential is configured for the organization. Add a key in this page first.
- You changed the key but runs still fail — confirm you saved the section you meant to. The Claude and Codex sections are stored independently, and the Codex agent will not fall back to the Anthropic key.