# Get an AI provider key

> Source: https://elaichi.ai/docs/guides/settings/ai-provider-keys/

The Elaichi Agent and workflow agent steps run on your organization's own AI provider keys. This page shows where to create a key at each provider, and how to add it to Elaichi.

:::callout{type="info"}
**Black plan.** The Agent and workflows are part of the Black plan. Adding a key needs the **Manage assistant** permission, which the built-in **Org Owner** and **Org Admin** roles include.
:::

Pick your provider:

- [Anthropic](#anthropic) for Claude models
- [OpenAI](#openai) for GPT models
- [Fireworks AI](#fireworks-ai) for open models such as GLM and Kimi
- [OpenRouter](#openrouter) for many providers with one key
- [OpenAI-compatible gateway](#openai-compatible-gateway) for your own proxy, such as LiteLLM

## Add the key to Elaichi

**Where to find it:** **Settings → AI models**

1. Open **Settings → AI models**.
2. Click **Add provider**, and pick your provider. Before your first provider, the page lists them all, so pick one there.
3. Paste the key in **API key**. For a gateway, also enter its **Base URL**.
4. Click **Check and save**.

Elaichi checks the key with the provider before it saves it. A key the provider refuses is not saved, and you see a message such as "Anthropic rejected this API key. Check it and paste it again."

**You'll know it worked when:** The provider shows **Works** and its models appear under **Models**. For most providers, the first key also adds a few models to start with.

You can add a key for more than one provider. Every model under **Models** can then be picked in the Agent and in each workflow agent step, so one step can run on Claude from Anthropic and the next on GLM from Fireworks AI.

:::callout{type="warning"}
**Copy the key when you create it.** Every provider below shows the full key only once. If you lose it, create a new key. Elaichi encrypts the key when you save it and never shows it again.
:::

## Anthropic

You create Anthropic keys in the Claude Console.

1. Sign in at [platform.claude.com](https://platform.claude.com/).
2. Open [API keys](https://platform.claude.com/settings/keys).
3. Click **Create key**.
4. Name the key, for example "Elaichi".
5. Choose an expiration. **Never** avoids a surprise outage. If you pick a date, add a new key in Elaichi before it expires.
6. Set **Linked account**. Choose a service account, so the key keeps working if the person who made it leaves your company.
7. Choose **one workspace** for the key.
8. Copy the key. It starts with `sk-ant-`.

:::callout{type="warning"}
**Scope the key to one workspace.** A key that works in several workspaces needs an extra workspace header on every request, and Elaichi doesn't send it. Anthropic answers those requests with an error.
:::

**Good to know**

- Your Anthropic organization needs credits. With no credits, Anthropic refuses every request. Buy credits on the [Billing](https://platform.claude.com/settings/billing) page.
- If **Create key** is turned off for you, your Anthropic role can't create keys. Ask an Anthropic organization admin.
- See Anthropic's own guide: [Get your Claude API key](https://platform.claude.com/docs/en/get-api-key).

## OpenAI

You create OpenAI keys on the OpenAI API platform. Each key belongs to a project.

1. Sign in at [platform.openai.com](https://platform.openai.com/).
2. Pick the project the key should belong to, from the project menu at the top.
3. Open [API keys](https://platform.openai.com/api-keys).
4. Click **Create new secret key**.
5. Name the key, for example "Elaichi".
6. Under permissions, choose **All**.
7. Copy the key.

:::callout{type="warning"}
**Restricted keys need two permissions.** If your company requires **Restricted** keys, the key must be allowed to list models and to send requests to models. Without the first one, Elaichi can't load your model list. A **Read only** key can't run the Agent.
:::

**Good to know**

- Your OpenAI organization needs prepaid credits. Add them under **Settings → Billing** on the OpenAI platform.
- A project admin can block some models for a project. A blocked model fails even with a working key.
- See OpenAI's own guide: [Where do I find my OpenAI API key?](https://help.openai.com/en/articles/4936850-where-do-i-find-my-openai-api-key)

## Fireworks AI

1. Sign in at [app.fireworks.ai](https://app.fireworks.ai/).
2. Open [API keys](https://app.fireworks.ai/settings/users/api-keys).
3. Click **Create API key**.
4. Name the key, for example "Elaichi".
5. Copy the key.

**Good to know**

- Fireworks AI bills in advance. Add a payment method and buy credits. When your balance reaches zero, Fireworks AI pauses requests unless auto reload is on.
- Only some Fireworks AI models can use tools. Elaichi lists only those, because the Agent needs tools.
- See Fireworks AI's own guide: [Quickstart](https://docs.fireworks.ai/getting-started/quickstart).

## OpenRouter

1. Sign in at [openrouter.ai](https://openrouter.ai/).
2. Open [Keys](https://openrouter.ai/settings/keys).
3. Create a new key and name it, for example "Elaichi".
4. Optionally set a credit limit for the key.
5. Copy the key. It starts with `sk-or-`.

:::callout{type="warning"}
**Use a regular API key, not a management key.** OpenRouter management keys can manage other keys, but they can't send requests to models.
:::

**Good to know**

- OpenRouter needs credits before it answers any request.
- When a key reaches its credit limit, OpenRouter refuses it until you raise the limit or the limit resets.
- See OpenRouter's own guide: [Authentication](https://openrouter.ai/docs/api-reference/authentication).

## OpenAI-compatible gateway

Use this when your company runs its own AI gateway or proxy, such as LiteLLM. Elaichi talks to it the way it talks to OpenAI.

Your gateway must:

- Be reachable on the public internet over `https://`. Elaichi doesn't connect to IP addresses, private hostnames or `localhost`.
- Answer `GET /models` and `POST /chat/completions` under the base URL you enter.
- Accept the key as `Authorization: Bearer <key>`.
- Answer directly, without a redirect. Elaichi doesn't follow redirects to a gateway.
- Offer at least one model that can use tools.

The **Base URL** is the part before `/models`, and usually ends in `/v1`, for example `https://ai-gateway.example.com/v1`.

**LiteLLM example**

1. In your LiteLLM proxy, create a virtual key. You can do this from the LiteLLM Admin UI, or with its `/key/generate` endpoint.
2. Give the key access to the models you want in Elaichi.
3. In Elaichi, enter your proxy's address with `/v1` at the end as the **Base URL**, and the virtual key as the **API key**.

See LiteLLM's own guide: [Virtual keys](https://docs.litellm.ai/docs/proxy/virtual_keys).

## Related

- [Roles and permissions](/guides/members/roles)
- [How Elaichi connects to AI clients](/guides/mcp-servers/how-it-works)