Skip to content

Configure your LLM provider

Every agent needs an LLM provider configured before its Chat tab — or any other AI surface — can call a model. This page walks through the LLM provider section on the agent Settings tab: pick a provider, enter a model and key, test it, and save.

For the broader manual-test checklist that exercises the chat surface end-to-end, see Portal chat testing.

Prerequisites

  • An organization you are a member of (any role works).
  • An agent in that organization. If you don't have one yet, see Building an agent.
  • An API key from one of the supported providers. See Supported providers below.

Supported providers

The dropdown lists four options:

Provider Value What you need
Anthropic anthropic An Anthropic API key.
OpenAI openai An OpenAI API key.
GLM (z.ai) glm A z.ai API key.
AWS Bedrock bedrock An IAM access key + secret + region (see Bedrock specifics).

The model is a free-text field — you type the exact model identifier (e.g. claude-4-opus, gpt-4o-mini, anthropic.claude-sonnet-4-20250514-v1:0). The placeholder updates to a sensible suggestion as you switch provider, but the platform does not pin a list — pick whichever model your account has access to.

Step 1: Open the LLM provider section

  1. Open the agent detail page.
  2. Switch to the Settings tab.
  3. Scroll to LLM provider.

If the agent has never had AI configured, the row reads Not configured and the button is Configure. Once a key is saved it switches to ✓ Configured and the button becomes Edit.

Step 2: Pick a provider

  1. Click Configure (or Edit).
  2. Select a provider from the dropdown.
  3. Enter the model identifier in the Model field.

Switching the provider clears any in-progress test result and swaps the placeholder to a model from that provider.

Step 3: Enter the API key

For Anthropic, OpenAI, and GLM, paste the API key into the single API key field.

For Bedrock, see Bedrock specifics — there are three credential fields instead of one.

The key never leaves your browser as plaintext beyond the request to the Hadron server, where it is encrypted at rest with the server's master key. The portal does not display the saved key back — once saved, the row shows only "✓ Configured".

When updating an existing config, leave the key field blank to keep the current key. The placeholder reminds you of this. You can change provider or model without re-entering the key.

Step 4: Test

Click Test to round-trip a one-line "are you there?" prompt through the configured provider.

  • ✓ Works — the green toast shows the provider, model, and the model's reply. You're done; click Save.
  • × Error — the red toast shows the provider's error message verbatim (401 Unauthorized, model not found, rate limit exceeded, etc.). Fix the cause and test again.

The Test endpoint uses the form values as you've typed them — you can test before saving. If you don't enter a new key but change provider/model, the saved key is merged in for the test.

Step 5: Save

Click Save. The form closes, the row switches to ✓ Configured, and the agent is ready for chat.

If the agent has a chatbot system memory and at least one non-setup conversation, the Chat tab now appears next to Settings. See Portal chat testing for the full smoke test.

Updating or clearing

To change the provider or rotate the key, click Edit and overwrite the fields. Leave the key blank to keep the existing one.

To remove the AI config entirely, click Edit then Clear. The portal asks for confirmation — "Clear AI config for this agent? The API key will be removed." — and on confirm deletes the saved provider, model, and key. The Chat tab disappears the next time the page reloads.

Bedrock specifics

When you pick AWS Bedrock, the form shows three credential fields plus a region selector:

Field What it is
AWS Access Key ID The IAM access key (AKIA… or temporary).
AWS Secret Access Key The IAM secret.
AWS Region Pick from us-east-1, us-west-2, eu-west-1, or ap-northeast-1.

Hadron stores the three values together (encrypted) and uses them to sign Bedrock InvokeModel calls. The model field takes the Bedrock model ID, not a friendly name — for example anthropic.claude-sonnet-4-20250514-v1:0, not claude-sonnet-4.

The IAM principal whose key you paste needs bedrock:InvokeModel on the model ARN in the chosen region. If it doesn't, Test returns a 403 AccessDenied from Bedrock.

Troubleshooting

Symptom What to check
Test returns 401 Unauthorized / invalid api key The key is wrong or revoked. Generate a fresh key in the provider's console and paste it again.
Test returns model not found / 404 The model identifier doesn't exist or your account lacks access. Verify the exact model string in the provider's console. Bedrock uses full model IDs (anthropic.claude-sonnet-4-20250514-v1:0), not short names.
Test returns a Bedrock 403 AccessDenied The IAM principal lacks bedrock:InvokeModel on that model ARN, or the region is wrong.
Save returns a permissions error Editing AI config requires you to be a member of the agent's organization. Sign in as a user who is.
Chat tab still missing after Save Saving AI config alone is not enough. The agent also needs a chatbot system memory and at least one non-setup conversation. See Building a chatbot agent.
Test reply text is gibberish or wrong The configured model returned something unexpected. Try a different model from the same provider, or check the provider's status page.
Saved a key, can't see it anywhere Intentional — the portal does not display saved keys. To replace it, Edit and paste a new value. To remove it, Clear.