Connect a provider

Before the gateway can route to a provider, you connect that provider to your project. You do it in the dashboard at Project → AI Gateway → Providers, using the connect drawer that opens when you select Connect provider. The drawer walks through four steps. You move forward as each step is complete.

​

1. Credential

Pick the provider from the catalog, then choose how to authenticate:

• Managed credential — you paste an API key (or the provider’s cloud credential) and to11 stores it encrypted. The gateway attaches it to every request it routes to that provider.
• BYOK / passthrough — no key is stored. Every request your application sends must carry the provider key itself in the Authorization header, and the gateway forwards it upstream. See Passthrough routing.

​

2. Name & routing

Give the connection a display name and a routing identifier. The routing identifier is the provider slug your requests name the provider by — <routing identifier>::<model>, shown under the field — so choose something durable. It cannot be changed after the provider is created. See Naming the provider in a request. The provider’s base URL is filled in from the catalog. Override it only when you reach the provider at a non-standard host — for example, a self-managed or regional endpoint.

​

3. Environments

Choose which of the project’s environments this connection is active in. A provider you only want in staging stays out of production until you activate it there.

​

4. Models

Choose the provider’s Access policy:

• Allow by default (the default) — allow all models except those that are explicitly blocked. The drawer shows no model picker for this setting; you add blocked patterns afterwards, on the provider’s Models tab.
• Deny by default — only allow models that are explicitly allowed. Deny otherwise. Add at least one model id. For most providers, Test connection validates your credential and discovers the available models to pick from; you can also type your own ids.

See Models for how the two settings behave. When you save, the connection is created with its credential, environment activations, and access policy in one step.

​

Change the access policy

The access policy is part of the provider’s version, so you change it on a draft and deploy the result like any other provider change:

1. Open the provider from Project → AI Gateway → Providers and go to its Models tab.
2. Select Start editing to create a draft.
3. Under Access policy, choose Allow by default or Deny by default. The tab then shows the list that setting uses.
4. Under Allow by default, add patterns in the Blocked models card and select Block for each one — for example *opus*, or an exact id such as gpt-4o. * matches any run of characters and matching ignores case. Remove a pattern with its X. Under Deny by default, turn on the models to allow in the Catalog models card, and add any other ids in the Custom models card.
5. Commit the draft as a new version.
6. On the Environments tab, deploy that version to each environment that should use it.

An environment keeps serving its current version until you deploy the new one, so you can try a change in staging before production. A committed version shows its access policy and its list read-only.

​

See also