Skip to main content
Settings → AI providers holds your organization’s own (bring-your-own) AI provider keys. You add a key once, and any monitor can run on it instead of Zelto’s built-in models. The page is at /org/<slug>/settings/ai-providers, and only owners and admins can open it (see roles).

​
Supported providers

You can store several keys for the same provider, for example one per team or environment. Each needs its own name.

​
Add a key

  1. Open Settings → AI providers and choose Add key on the provider.
  2. Paste the key from your provider’s dashboard. Optionally give it a name; it defaults to the provider name.
  3. Choose Save key.
Zelto checks the key with a no-cost call to the provider (such as listing its models) before saving it. A key the provider rejects is not saved, and if the provider can’t be reached, nothing is saved and you can try again. The key is stored encrypted. After that, only its last four characters are ever shown, in the app, the API, and MCP.

​
Test, rotate, rename, and remove

  • Test checks a saved key again and shows Working or Check failed. A failed key is reported, not removed.
  • Rotate replaces the secret. The new key is checked first, so a typo leaves the current key in place. Every monitor on the key switches to the new secret at once, because monitors reference the key rather than copying it. Leave the key field blank to only rename.
  • Remove deletes the key. It is refused while any monitor still runs on it, and the list of those monitors is shown: switch them to another key or the built-in model first.
Adding, rotating, renaming, and removing a key each write an audit log entry (ai_key.created, ai_key.rotated, ai_key.renamed, ai_key.deleted) with the provider, name, and last four characters. The secret is never logged.

​
Use a key in a monitor

In the monitor editor’s model settings, pick the provider, then choose one of the organization’s keys for it and enter the provider’s own model ID (for example gpt-5, claude-sonnet-4-5, or anthropic/claude-sonnet-4.5 on OpenRouter and the gateway). If there is no key yet for that provider, the editor links to this page. Choosing which key a monitor uses is owner/admin only. The Try it step uses the same key, so you can test a monitor on it before saving. See Try it before enabling. From the API, PUT /v1/monitors/{id}/model with { "aiKeyId": "…", "model": "gpt-5" } puts a saved monitor on a key, and { "provider": "bedrock" } (with an optional modelTier) moves it back to the built-in model. Over MCP the same change is set_monitor_model, and test_monitor with aiKeyId and model tries it first. Changing the provider or model starts a new monitor version and resets its alert; switching to another key of the same provider does not.

​
Billing

  • Your provider bills you directly for the tokens used on your key.
  • That usage does not count toward your plan’s monitor runs or monitor tokens. See Plans, limits and retention.
  • Zelto charges a bring-your-own platform fee for running the pipeline, storage, and results around those calls: a percentage of the usage’s estimated list-price cost. The default is 5%; your agreement can set a different rate, including 0%. The fee appears on Settings → Usage and as a line on your monthly usage invoice.
The estimated list price is Zelto’s estimate from published model prices (the OpenRouter and Vercel AI Gateway model catalogs, refreshed every few hours, plus published OpenAI, Anthropic and TypeSafe prices), not your provider’s invoice. A model Zelto has no published price for (including models a catalog lists as free, and variable-price routers such as openrouter/auto) can’t carry a percentage, so each call to it carries a small flat fee instead: $0.00001 at the default 5% rate ($0.01 per 1,000 calls, about 5% of a typical TypeSafe Jev call), scaled with your rate.

​
PHI mode

Organizations in PHI mode can’t add or rotate keys: call content can’t be sent to a third-party provider under your own key. If an organization with keys turns on PHI mode, those keys stop being used right away and can only be removed. The same applies to a key saved on an individual monitor before organization keys existed: monitors in a PHI-mode organization run only on Zelto’s built-in models.

​
API and MCP

Everything on this page is also available programmatically, with the same checks and errors. Both need an owner or admin key.
  • REST: GET/POST /v1/ai-keys, GET/PATCH/DELETE /v1/ai-keys/{id}, POST /v1/ai-keys/{id}/test, and PUT /v1/monitors/{id}/model. See the API reference, under AI providers.
  • MCP: list_ai_keys, create_ai_key, update_ai_key, test_ai_key, delete_ai_key, set_monitor_model, and the aiKeyId and model inputs of test_monitor. See AI provider keys on the MCP page.
When a person can paste the key, use the Settings page: over the API or MCP the secret passes through whatever script or agent sends it.
  • Monitors — the judges that run on these keys.
  • Settings — usage, billing, and the audit log.
  • MCP — manage keys from an AI client.