Skip to main content
Every chat call runs against an API key you supply — Anthropic, OpenAI, Google Gemini, Groq, Mistral, Azure OpenAI, OpenRouter, or a self-hosted Ollama.
  • The model bill goes to you. No per-token markup from CoreBase.
  • You pick the model. Want Sonnet 4 for analysis, GPT-4o for chat? Add both, set one as default.
  • You rotate at your pace. Update the key in the panel; takes effect on the next call.

​
Adding a key

In Settings → LLM provider keys, click Add key.
1

Pick a provider

Choose from the dropdown.
2

Paste your API key

The form treats it as a password. Once saved, the value is never displayed again — only the last 4 characters are shown as a recognition hint.
3

(Optional) Pick a model

Each provider has a built-in default. Override with any model the provider exposes.
4

(Optional) Custom base URL

For OpenAI-compatible endpoints (Azure OpenAI, OpenRouter, self-hosted Ollama) drop in the alternate base URL. The field is hidden for providers that use a fixed endpoint.
5

Save

Your first key is promoted to default automatically. Promote a later key via Set default.

​
Default provider

Chat calls run against whichever key is marked default. One default per organization; setting a new one demotes the old one automatically.

​
Supported providers

Need a provider not on this list? Email [email protected].

​
Multiple keys per organization

You can store one key per provider. Use cases:
  • A/B model testing: keep both Anthropic and OpenAI keys, switch defaults to compare.
  • Cost tuning: a cheap model for chat, a premium model for analytics-heavy work — flip the default before the heavy job.
  • Multi-region failover: an Azure key per region, swap defaults when one is unavailable.

​
Rotating a key

In the table, edit the row and paste the new value. New chat calls use the new key from the next request onward. If the old key was compromised, revoke it at the provider first (their dashboard is the source of truth), then update CoreBase.

​
Security

API keys are encrypted at rest, scoped per organization, and decrypted only in memory during a chat call. Plaintext keys are never written to logs or returned in any API response.

​
Errors

When your provider rejects a key (auth or quota), the chat surfaces a short message pointing to Settings — the raw provider error stays out of the response.