> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usekolaos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AI providers

Organization admins connect providers under **Organization**, then **AI providers**. Workspace admins then enable tools and choose default models under **AI governance**. Developers do not supply personal provider credentials to the preinstalled tools.

## Choose a connection method

| Method | Providers | What you supply |
| - | - | - |
| Workload identity | Anthropic and OpenAI | The provider configuration and IDs shown in the guided setup. |
| API key | Anthropic, OpenAI, Google, Amazon Bedrock and OpenRouter | The provider credential requested by the connection form. |

Workload identity uses short-lived access tokens instead of a stored provider API key. It needs an AWS identity for the AI gateway, so **Your servers** supports API keys only. KolaOS stores API keys encrypted; admins control provider connections.

## Connect with workload identity

Choose **Connect provider**, select Anthropic or OpenAI, and choose **Workload identity**. Use the values shown by KolaOS for your organization rather than values from another setup.

**Anthropic**

You need an admin or owner account in the Claude Console and a workspace for KolaOS.

1. Follow the guided steps to register the AWS workload identity issuer.
2. Create the federation rule with the role ARN and the organization-specific CEL condition shown by KolaOS. Under advanced match options, enter the subject pattern again as directed.
3. Limit the rule to the intended Claude workspace and create its service account.
4. Paste the test snippet requested by KolaOS, then choose **Test and connect**. The snippet supplies configuration IDs; KolaOS refuses a paste containing an API key.

**OpenAI**

You need an owner account in the OpenAI organization and a project for KolaOS.

1. Create the workload identity provider using the issuer, audience and organization attribute transformation shown by KolaOS.
2. Create the service account mapping with the role ARN as the subject and your KolaOS organization ID as the organization attribute.
3. Restrict the service account to the model-listing, Responses and Chat completions permissions requested by the guide.
4. Enter the provider ID and service account user ID, then choose **Test and connect**.

The connection test exchanges a token, lists models and checks that a token for another KolaOS organization is refused. A failed test does not save the connection. Fix the reported issuer, role, organization condition or provider permission, and test again.

## Connect with an API key

Choose **Connect provider**, select the provider and enter the credential requested by the form. Use a credential dedicated to your organization and follow the form's validation before saving.

For Amazon Bedrock, the role must trust the AI gateway's role and require the KolaOS organization ID as its external ID. Use the values supplied by KolaOS.

Do not put provider keys in repository files or workstation environment settings. The node gateway adds the member's KolaOS AI key outside the workstation when it forwards a request. Direct requests from a workstation to a provider are not blocked on nodes yet.

## Enable a workspace tool

Open the workspace's **AI governance** page, enable the tool, and choose a default model that a connected provider serves.

| State | Admin action | Developer action |
| - | - | - |
| No provider | Connect a provider that serves the tool's models. | Ask an admin. |
| Model not served | Choose a served default model. | Ask an admin. |
| Provider not working | Open the provider, fix the reported setup and test again. | Ask an admin. |

KolaOS tests workload identity connections daily. Use **Fix setup** or **Test connection** after changing the provider configuration. If the AI gateway's role changes, update the role ARN at the provider.

## Disconnect or replace a credential

Choose **Disconnect** from the provider's menu to remove its KolaOS connection. Revoke an old API key at the provider as well, because deleting KolaOS's stored copy does not revoke other copies.

For Anthropic or OpenAI connected by API key, choose **Switch to workload identity** and complete the guide. KolaOS replaces the stored key after the connection test passes. Revoke the old key at the provider afterward.

## Usage and prompt records

Admins set the organization cap under **Usage and budget**. The organization cap is enforced; separate member and workspace spending limits are not enforced today.

KolaOS records requests and responses with no recording opt-out. Admins choose **Prompt retention** on **AI providers** and inspect **Prompt records**. Read [AI tools and prompt records](https://docs.usekolaos.com/development/ai-tools.md#prompt-records) before enabling tools for your team.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.