Skip to main content
Organization admins connect providers under Organization, then AI providers. Workspace admins then enable tools and choose default models under AI governance. Developers do not supply personal provider credentials to the preinstalled tools.

​
Choose a connection method

Workload identity uses short-lived access tokens instead of a stored provider API key. It needs an AWS identity for the AI gateway, so Your servers supports API keys only. KolaOS stores API keys encrypted; admins control provider connections.

​
Connect with workload identity

Choose Connect provider, select Anthropic or OpenAI, and choose Workload identity. Use the values shown by KolaOS for your organization rather than values from another setup.
You need an admin or owner account in the Claude Console and a workspace for KolaOS.
  1. Follow the guided steps to register the AWS workload identity issuer.
  2. Create the federation rule with the role ARN and the organization-specific CEL condition shown by KolaOS. Under advanced match options, enter the subject pattern again as directed.
  3. Limit the rule to the intended Claude workspace and create its service account.
  4. Paste the test snippet requested by KolaOS, then choose Test and connect. The snippet supplies configuration IDs; KolaOS refuses a paste containing an API key.
The connection test exchanges a token, lists models and checks that a token for another KolaOS organization is refused. A failed test does not save the connection. Fix the reported issuer, role, organization condition or provider permission, and test again.

​
Connect with an API key

Choose Connect provider, select the provider and enter the credential requested by the form. Use a credential dedicated to your organization and follow the form’s validation before saving. For Amazon Bedrock, the role must trust the AI gateway’s role and require the KolaOS organization ID as its external ID. Use the values supplied by KolaOS. Do not put provider keys in repository files or workstation environment settings. The node gateway adds the member’s KolaOS AI key outside the workstation when it forwards a request. Direct requests from a workstation to a provider are not blocked on nodes yet.

​
Enable a workspace tool

Open the workspace’s AI governance page, enable the tool, and choose a default model that a connected provider serves. KolaOS tests workload identity connections daily. Use Fix setup or Test connection after changing the provider configuration. If the AI gateway’s role changes, update the role ARN at the provider.

​
Disconnect or replace a credential

Choose Disconnect from the provider’s menu to remove its KolaOS connection. Revoke an old API key at the provider as well, because deleting KolaOS’s stored copy does not revoke other copies. For Anthropic or OpenAI connected by API key, choose Switch to workload identity and complete the guide. KolaOS replaces the stored key after the connection test passes. Revoke the old key at the provider afterward.

​
Usage and prompt records

Admins set the organization cap under Usage and budget. The organization cap is enforced; separate member and workspace spending limits are not enforced today. KolaOS records requests and responses with no recording opt-out. Admins choose Prompt retention on AI providers and inspect Prompt records. Read AI tools and prompt records before enabling tools for your team.