Skip to main content
Agents never hold provider API keys. An environment’s admins add providers (an OpenAI account, a Bedrock region, a vLLM server…) on the Models page and tick the models agents may use. Agents then call those models through the AgentOS gateway with their run token. See Call a model for the agent’s side. Each environment has its own providers and models: a run only ever reaches the models of its own environment.

​
Supported providers

Keys are write-only: they are stored encrypted and never shown again. To change one, enter a new value. For Bedrock, saving one way of signing in removes the other’s stored keys.

​
Add a provider

1

Choose the type

Open Models → Add provider and choose a provider type.
2

Name it and enter its settings

Give it a name. Its slug (lowercase letters, digits and -, such as bedrock-prod) is filled in from the name and can’t be changed once saved, because agents use it in model names. Enter the settings and keys from the table above.
3

Tick the models

After saving you land on the provider’s Edit models page. AgentOS asks the provider which models it serves and lists them. Tick the ones agents may use and click Save and sync. Ticked models are pushed to the gateway; unticked ones are removed from it.
Azure OpenAI deployments can’t be listed, and some servers don’t answer the list. In that case use Add model and type the model ID (for Azure, the deployment name). Model IDs can’t contain spaces or commas.

​
Model names

Every model is named <provider slug>/<model ID>, exactly as the Models page lists it:
That is the name agents put in config.models in agentos.yaml, and the name experiments use to try another model:
agentos.yaml
Every model named in config.models must exist on the Models page of the environment you deploy to, or the upload is refused.

​
Models in use

A model can’t be unticked or deleted while something depends on it: a live version, a candidate or a version still building that names it in its config, an AI judge evaluator, or an experiment that hasn’t finished and overrides with it. Move those to another model first. Each model row shows its sync state with the gateway (SYNCED, SYNCING, SYNC FAILED). If a sync failed, fix the cause and click Sync to try again.

​
Usage

The Models page shows each model’s calls, tokens and cost over the last 30 days. Cost comes from a public price table; models it doesn’t price, such as models on your own servers, are shown as on-prem at $0. The same numbers per run are on each run’s page, and per agent on its Overview tab. See Metrics.

​
Privacy

The gateway doesn’t store prompts or responses. For each model call AgentOS keeps only the model, token counts, cost, latency and the names of the tools the model asked for. To control what reaches a model (national IDs, card numbers, secrets…), add guardrails.