Bring your own LLM
Add OpenAI, Anthropic, or Google Vertex keys so agent traffic flows through your contract — your usage, your billing, your data-residency story.
Why bring your own keys
ThorStack supports — and on every plan, prefers — that you bring your own LLM keys. When you do:
- Agent traffic routes through your contract with the provider.
- Usage shows up on your bill, not buried inside ours.
- Data residency follows the provider's residency story (e.g. Vertex region pinning).
- You can switch models per agent without renegotiating with us.
Supported providers
| Provider | Models |
|---|---|
| OpenAI | GPT-4o, GPT-4o-mini, o-series, future-released models. |
| Anthropic | Claude family, including 1M-context variants. |
| Google Vertex | Gemini family, with GCP-region data residency. |
Multiple providers can be configured at once — you might run sales drafting on Anthropic and structured extraction on OpenAI.
Adding a key
- Open Settings → LLM providers.
- Click Add key for the provider.
- Paste the secret key. ThorStack writes it to per-tenant secret storage immediately and never echoes it back. See Encryption & secrets.
- Optionally pin a region (Vertex) or an organization (OpenAI / Anthropic).
- Verify with the built-in test call — it makes one tiny round-trip and shows the response.
Routing
By default, every agent uses your platform-default provider. You can override:
- Per agent — Forge uses Anthropic, Echo uses OpenAI.
- Per workflow — a "draft contract" workflow always uses Claude.
- Per task type — short JSON extraction goes to a small model; long-form drafting goes to a large one.
The router picks based on the most specific rule that matches.
Cost attribution
Every LLM call is logged with token counts and the provider it went to. Mission Control shows:
- Cost per agent, per workflow, per module — for the period you pick.
- Top-N most expensive runs, so you can debug a runaway draft.
- Forecast vs actual — if a workflow is trending over budget, you see it before the bill.
Failover
Configure a fallback chain per agent. If the primary provider returns 5xx or rate-limits, the agent retries on the fallback. The trace records both attempts so you can see when it kicked in.
Next
- Agent management — turn agents on/off and configure routing.
- Encryption & secrets — how keys are stored.