> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentbees.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# LLM configuration

> Configure your org's provider, model, keys, and policy under Admin → Agent LLM.

An org admin configures how agents reach their models under **Admin → Agent LLM**.
Until an LLM is configured, tasks can't be dispatched.

<Frame caption="Admin → Agent LLM — provider, model, endpoint, and write-only keys.">
  <img src="https://mintcdn.com/agent-bees/HUTI08XX3esZvrRw/images/admin-agent-llm.png?fit=max&auto=format&n=HUTI08XX3esZvrRw&q=85&s=adbe8cba8ce61181f95c8bc66f4c485f" alt="Admin Agent LLM configuration" width="1440" height="900" data-path="images/admin-agent-llm.png" />
</Frame>

<Info>
  This panel is **org-admin only**, and all API keys are **write-only** — you set them, and the UI
  only ever shows whether a key is configured, never its value. Keys are encrypted at rest.
</Info>

## Provider & model

<Steps>
  <Step title="Pick a provider">
    Anthropic API, Internal gateway, AWS Bedrock, Google Vertex AI, or Azure AI (see [Claude
    Code](/agents/claude-cli) for what each means).
  </Step>

  <Step title="Set the model">
    A free-text field with per-provider suggestions. It's free-text because Bedrock/Vertex take
    inference-profile IDs or ARNs — enter exactly what your backend exposes. Provider and model must
    be set **together**.
  </Step>

  <Step title="Add a key (Anthropic / gateway only)">
    Bedrock, Vertex, and Azure authenticate via cloud identity and store no key.
  </Step>
</Steps>

## Per-agent keys

Codex and Gemini use their own keys:

* **OpenAI key (Codex)** — needed only if you enable Codex.
* **Google key (Gemini)** — needed only if you enable Gemini.

Both are write-only and encrypted. You can also set an optional custom endpoint
and model per agent (e.g. an OpenAI-compatible gateway).

## Org policy

The policy section governs what users may do:

| Policy                | What it controls                                                                              |
| --------------------- | --------------------------------------------------------------------------------------------- |
| **Provider policy**   | `open`, or `gateway_only` to force every task through the internal gateway                    |
| **Allowed providers** | Restrict which providers a task may use                                                       |
| **Model allowlists**  | Per-agent (Claude / Codex / Gemini) — with 2+, users get a Model dropdown                     |
| **Agent allowlist**   | Which CLIs (Claude / Codex / Gemini / Kiro) users may launch                                  |
| **Gateway auth**      | `stored_key` (encrypted org key) or `sso_brokered` (short-lived per-task credential from SSO) |
| **Web IDE**           | Enable the premium Web IDE for tasks                                                          |

<Warning>
  With `gateway_only`, any attempt to save or run a non-gateway provider is rejected. This is
  enforced both in the UI and server-side (and backstopped by a database constraint).
</Warning>

## Common pitfalls

* **No LLM configured** → "Tasks can't be dispatched until one is set."
* **Provider without a model (or vice-versa)** → they must be set together.
* **Gateway base URL with a trailing `/v1`** → see [Internal gateway](/agents/internal-gateway).