LLM Providers
Deployment.io's agents — the ones that run Tasks and Assistant sessions — call an LLM on your vendor account. You configure a provider once per organization, and every agent run from then on uses it. Usage is billed by the vendor directly; Deployment.io doesn't resell tokens.
Supported providers
| Provider | Credential | Used by |
|---|---|---|
| Anthropic | Anthropic API key | The Claude Code and opencode agents |
| OpenAI | OpenAI API key | The Codex and opencode agents |
| AWS Bedrock | None — your own AWS account | The Claude Code and opencode agents |
Each provider is configured independently — saving one never touches another. You only need the provider for the agent you actually use. The per-provider pages cover setup and provider-specific troubleshooting; everything on this page applies to all of them.
Tasks are blocked until a provider is configured. Creating a Task requires the organization to have at least one usable agent credential. If you haven't added one, Task creation is refused.
Where to find it
Organization Settings → Agents → LLM Providers (https://app.deployment.io/org-settings/agents).
The page shows one card per provider. API-key providers have their own input and Save button; AWS Bedrock is enabled with a single click, since it stores no credential.
How credentials are stored
- Encrypted at rest. Keys are encrypted with AES-GCM before they're written to the database. They are never stored in plaintext.
- Never re-displayed. After you save, the dashboard and the API only ever return a masked form of the key.
- Decrypted only at run time. When an agent job starts, the key is decrypted and passed to the sandboxed agent container running on your runner.
Rotating a key
Once a key is saved, its section shows it masked — the first few and last few characters only, with the middle redacted. The plaintext is never returned to the browser again.
To rotate:
- Click Replace next to the masked key.
- Paste the new key into the New API key field.
- Click the section's Save button.
The existing key stays active until the new one is saved, so there's no window where agents are left without a credential. Click Cancel to back out without changing anything.
To stop using a provider entirely, click Remove on its card. If no other provider is configured afterwards, Task creation is blocked until one is.
Validation
Every provider's key field applies the same sanity checks before anything is saved:
| Condition | Result |
|---|---|
| Empty | "API key is required" — the Save button stays disabled |
| Fewer than 20 characters | "API key looks too short — double-check the value you pasted" |
| More than 500 characters | Rejected — check that you pasted only the key, not surrounding text |
These catch truncated or mis-pasted values. They don't verify the key against the vendor, so a well-formed but revoked key will save successfully and fail later at run time.
Troubleshooting
- You can't create a Task at all — no agent credential is configured for the organization. Add one for the provider your agent uses.
- You changed a key but runs still fail — confirm you saved the section you meant to. Providers are stored independently, and an agent never falls back to another provider's key.
For provider-specific issues — key format, revoked keys, spend limits, Bedrock model access — see the Anthropic, OpenAI, and AWS Bedrock pages.
Connecting your own coding agent over MCP? It uses its own credentials, not these — see MCP Configuration.