# Bring your own LLM import { Steps, TabItem, Tabs } from "@astrojs/starlight/components" **Bring your own LLM** lets Org Admins connect Mindflow to LLM infrastructure you already run—OpenAI, Anthropic, Azure AI Foundry, LiteLLM, Google Gemini, Mistral, and similar providers—and choose which providers are available in the organization. You create a credential for the provider, enable it under **Allowed AI providers**, then pick those models in an **AI··Task**. OpenAI and Amazon Bedrock can also stay on credentials provided by Mindflow. ## When to use - Your security or compliance policy requires LLM calls to go through your own OpenAI, Anthropic, Azure AI Foundry, LiteLLM, Gemini, or Mistral account. - You want Org Admins to turn providers on or off for AI··Task, Agents, and AI··Rooms. - Prefer Mindflow-hosted models when you do not need a customer credential—leave the provider on **Provided by Mindflow** for OpenAI or Amazon Bedrock. Before you begin, you need **Org Admin** rights. For Anthropic, Azure AI Foundry, LiteLLM, Gemini, or Mistral, have the provider endpoint and API key (or headers) ready. LiteLLM may be off for your tenant until Mindflow enables it. ## Guide ### Create a provider credential Credentials for customer-hosted vendors live in the **Organization environment** so the organization can link them under **Allowed AI providers**. Create one credential per provider you plan to enable with your own key. Create an **OpenAI** credential (HTTP API key style) with the API base URL and an **Authorization** header.
  1. **Open Environments.** Open the **Organization environment**, then create a credential for **OpenAI**.
  2. **Set the URL.** Choose the OpenAI API base (for example `https://api.openai.com/v1`) or your compatible endpoint.
  3. **Add the Authorization header.** Under **Headers**, set **Name** to `Authorization` and **Value** to `Bearer` plus your API key (include the word `Bearer`).
  4. **Create the credential.** Confirm so it appears for OpenAI under **Allowed AI providers**.
Create an **Anthropic** credential for [api.anthropic.com](https://docs.anthropic.com/en/api/getting-started). Studio uses an **HTTP API Key** with an `x-api-key` header. Models come from the Anthropic catalog after you enable the provider—you do not list deployments on this credential.
  1. **Open Environments.** Open the **Organization environment**, then create a credential for **Anthropic**.
  2. **Keep the Anthropic URL.** Leave the default `https://api.anthropic.com` unless you use a compatible proxy.
  3. **Add the x-api-key header.** Expand **Headers**, add an item, set **Key** to `x-api-key`, and paste your Anthropic API key into **Value** (raw key only—no `Bearer` prefix).
    ![Create an Anthropic credential with x-api-key header filled](./assets/create-credential-anthropic-api-key.png)
  4. **Create the credential.** Confirm so it appears for Anthropic under **Allowed AI providers**.
Create an **Azure AI Foundry API key** credential (credential type **Azure AI Foundry**). The URL comes from the credential target server; models come from **Model Deployments** on the credential.
  1. **Open Environments.** Open the **Organization environment**, then create a credential for **AI Foundry** (Azure AI Foundry).
  2. **Set the endpoint URL.** In Studio, fill **Endpoint** with the Foundry resource origin from [Azure AI Foundry](https://ai.azure.com/foundryResource)—for example `https://.services.ai.azure.com` (the URL field may show `https://{endpoint}`). A project URL that includes `/api/projects/…` is fine; Mindflow normalizes it to the resource origin.
    ![Azure AI Foundry Overview with Endpoints and keys and API Key highlighted](./assets/azure-ai-foundry-overview-endpoints-keys.png)
  3. **List model deployments.** For each deployment, set **Deployment Name** (Name in Azure) and **Deployment ID** (model name in Azure). Match the rows under **Models + endpoints** in Azure AI Foundry—for example **Deployment Name** `gpt-4o` with **Deployment ID** `gpt-4o`.
    ![Azure AI Foundry Model deployments list with Name and Model name columns](./assets/azure-ai-foundry-model-deployments-list.png)
    ![Azure AI Foundry credential with Endpoint API Key and Model Deployments](./assets/create-credential-azure-ai-foundry-claude.png)
  4. **Add the API key.** Paste the raw API key into **API Key** (no `Bearer` prefix). Expand **Model Deployments**, add each row, then create the credential.
Create a **LiteLLM API key** credential. Keep the credential type as LiteLLM. Fill **Models** with the same pairs your proxy exposes, then add auth headers.
  1. **Open Environments.** Open the **Organization environment**, then create a credential for **LiteLLM**.
  2. **Set the proxy URL.** Point the credential URL at your LiteLLM OpenAI-compatible base (for example `https://endpoint.example.com/openai`).
  3. **Fill Models.** For each entry, set **Model Name** (friendly name used in Mindflow) and **Model ID** (provider model id from the proxy). Match your LiteLLM `model_list` (for example `model_name: gpt-4o` with `model: gpt-4o-2024-08-06`).
    ![Create a credential for LiteLLM with Custom URL and Models Model Name and Model ID filled](./assets/create-credential-litellm-custom-url-models.png)
  4. **Add Headers.** Add the headers your proxy expects (for example `Authorization: Bearer …` or `X-Litellm-Key`). See [LiteLLM virtual keys](https://docs.litellm.ai/docs/proxy/virtual_keys). Create the credential.
Create a **Google Gemini** credential (HTTP API key style) with an `X-goog-api-key` header. Models come from the Gemini catalog after you enable the provider—you do not list deployments on this credential.
  1. **Open Environments.** Open the **Organization environment**, then create a credential for **Gemini**.
  2. **Choose HTTP API Key.** Use credential type **HTTP API Key**.
  3. **Add the X-goog-api-key header.** Under **Headers**, set **Key** to `X-goog-api-key` and **Value** to your Gemini API key (raw key only—no `Bearer` prefix). Create the key in [Google AI Studio](https://aistudio.google.com/app/api-keys).
  4. **Create the credential.** Confirm so it appears for Gemini under **Allowed AI providers**.
Create a **Mistral** credential (HTTP API key style) with an **Authorization** header. Models come from the Mistral catalog after you enable the provider—you do not list deployments on this credential.
  1. **Open Environments.** Open the **Organization environment**, then create a credential for **Mistral**.
  2. **Keep the Mistral URL.** Leave the default Mistral API base (for example `https://api.mistral.ai/v1`) unless you use a compatible proxy.
  3. **Add the Authorization header.** Under **Headers**, set **Key** to `Authorization` and **Value** to `Bearer` plus your API key (include the word `Bearer`). Create the key in the [Mistral console](https://console.mistral.ai/).
  4. **Create the credential.** Confirm so it appears for Mistral under **Allowed AI providers**.
### Enable providers in Organization **Allowed AI providers** on the Organization page controls which vendors appear in AI··Task, Agents, and AI··Rooms. Enable a provider, then choose **Provided by Mindflow** (OpenAI or Amazon Bedrock) or a credential you created. Changes save automatically—there is no separate Save control.
  1. **Open Organization.** In Studio, open your profile menu, then choose **Organization**.
  2. **Open Allowed AI providers.** Scroll to **Allowed AI providers**.
    ![Organization Allowed AI providers with vendor checkboxes and credential pickers](./assets/allowed-ai-providers.png)
  3. **Enable the provider.** Check the vendor you need. Only enabled providers are available to the organization.
  4. **Link the credential.** For Anthropic, Azure AI Foundry, LiteLLM, Gemini, or Mistral, choose the credential you created. For OpenAI or Amazon Bedrock, leave **Provided by Mindflow** or select your own OpenAI credential when you use one.
### Use models in an AI··Task After a provider is enabled, its models appear in the AI··Task model picker (catalog models for Mindflow-hosted vendors, Anthropic, Gemini, and Mistral; credential model lists for Azure AI Foundry and LiteLLM).
  1. **Add an AI··Task.** In a flow, add an **AI··Task** step and open **Input**.
    ![Draft incident summary flow with Summarize alert AI··Task Input open and Model GPT-5.2 selected](./assets/ai-task-model.png)
  2. **Choose the model.** Pick a model from an enabled provider. If the same model name exists on two providers, choose the provider you intend.
  3. **Run a test.** Fill the required prompt fields and run the step to confirm the credential and model respond.
## Example A security team routes triage prompts through **Anthropic** and enrichment through **Google Gemini**. An Org Admin creates an Anthropic credential (`x-api-key`), enables **Anthropic** under **Allowed AI providers**, and picks a Claude model on AI··Task. For Gemini, they create a Gemini credential (`X-goog-api-key` from Google AI Studio), enable **Gemini**, then select a Gemini model on another AI··Task. 1. **Create the Anthropic credential.** Organization environment → Anthropic → Headers → `x-api-key` → Create. 2. **Enable Anthropic.** Organization → Allowed AI providers → check Anthropic → select the credential. 3. **(Optional) Create the Gemini credential.** Organization environment → Gemini → Headers → `X-goog-api-key` → enable Gemini and pick a catalog model on AI··Task. ## Keep in mind - Grant access only to the models you need (least privilege on the provider side). - Amazon Bedrock stays Mindflow-hosted; you cannot attach a customer Bedrock credential in Allowed AI providers. - Provider availability depends on organization feature flags (LiteLLM is often off until Mindflow enables it). - Gemini and Mistral use catalog models after you link the credential—same pattern as Anthropic (no deployment list on the credential). Related: [Use AI in flows](../../../build/use-ai-in-flows/), [Manage permissions (RBAC)](../../manage-access/manage-permissions-rbac/).