# LLM Providers

---

Deployment.io's agents — the ones that run Tasks and Assistant sessions — call an LLM on **your** vendor account. You configure a provider once per organization, and every agent run from then on uses it. Usage is billed by the vendor directly; Deployment.io doesn't resell tokens.

## Supported providers

| Provider                                       | Credential                  | Used by                             |
| ---------------------------------------------- | --------------------------- | ----------------------------------- |
| [Anthropic](/docs/ai-providers/anthropic/)     | Anthropic API key           | The Claude Code and opencode agents |
| [OpenAI](/docs/ai-providers/openai/)           | OpenAI API key              | The Codex and opencode agents       |
| [AWS Bedrock](/docs/ai-providers/aws-bedrock/) | None — your own AWS account | The Claude Code and opencode agents |

Each provider is configured independently — saving one never touches another. You only need the provider for the agent you actually use. The per-provider pages cover setup and provider-specific troubleshooting; everything on this page applies to all of them.

> **Tasks are blocked until a provider is configured.** Creating a Task requires the organization to have at least one usable agent credential. If you haven't added one, Task creation is refused.

## Where to find it

**Organization Settings → Agents → LLM Providers** (`https://app.deployment.io/org-settings/agents`).

The page shows one card per provider. API-key providers have their own input and Save button; AWS Bedrock is enabled with a single click, since it stores no credential.

---

## How credentials are stored

- **Encrypted at rest.** Keys are encrypted with AES-GCM before they're written to the database. They are never stored in plaintext.
- **Never re-displayed.** After you save, the dashboard and the API only ever return a masked form of the key.
- **Decrypted only at run time.** When an agent job starts, the key is decrypted and passed to the sandboxed agent container running on your runner.

## Rotating a key

Once a key is saved, its section shows it masked — the first few and last few characters only, with the middle redacted. The plaintext is never returned to the browser again.

To rotate:

1. Click **Replace** next to the masked key.
2. Paste the new key into the **New API key** field.
3. Click the section's **Save** button.

The existing key stays active until the new one is saved, so there's no window where agents are left without a credential. Click **Cancel** to back out without changing anything.

To stop using a provider entirely, click **Remove** on its card. If no other provider is configured afterwards, Task creation is blocked until one is.

## Validation

Every provider's key field applies the same sanity checks before anything is saved:

| Condition                | Result                                                              |
| ------------------------ | ------------------------------------------------------------------- |
| Empty                    | "API key is required" — the Save button stays disabled              |
| Fewer than 20 characters | "API key looks too short — double-check the value you pasted"       |
| More than 500 characters | Rejected — check that you pasted only the key, not surrounding text |

These catch truncated or mis-pasted values. They don't verify the key against the vendor, so a well-formed but revoked key will save successfully and fail later at run time.

## Troubleshooting

- **You can't create a Task at all** — no agent credential is configured for the organization. Add one for the provider your agent uses.
- **You changed a key but runs still fail** — confirm you saved the section you meant to. Providers are stored independently, and an agent never falls back to another provider's key.

For provider-specific issues — key format, revoked keys, spend limits, Bedrock model access — see the [Anthropic](/docs/ai-providers/anthropic/), [OpenAI](/docs/ai-providers/openai/), and [AWS Bedrock](/docs/ai-providers/aws-bedrock/) pages.

---

Connecting your own coding agent over MCP? It uses its own credentials, not these — see [MCP Configuration](/docs/coding-agents/mcp-configuration/).

---

Source: https://deployment.io/docs/ai-providers/llm-providers/