> ## Documentation Index > Fetch the complete documentation index at: https://docs.zelto.ai/llms.txt > Use this file to discover all available pages before exploring further. # AI providers > Store your organization's own OpenAI, Anthropic, OpenRouter, Vercel AI Gateway, TypeSafe, and Deepgram keys once, and run monitors on them. **Settings → AI providers** holds your organization's own (bring-your-own) AI provider keys. You add a key once, and any [monitor](https://docs.zelto.ai/docs/monitors.md) can run on it instead of Zelto's built-in models. The page is at `/org//settings/ai-providers`, and only owners and admins can open it (see [roles](https://docs.zelto.ai/docs/settings.md)). ## Supported providers | Provider | What the key is for | | - | - | | **OpenAI** | GPT models through your OpenAI account. | | **Anthropic** | Claude models through your Anthropic account. | | **OpenRouter** | Hundreds of models through one OpenRouter key. | | **Vercel AI Gateway** | Models from many providers through your gateway key. | | **TypeSafe** | Typed yes/no, category, and score decisions. See [TypeSafe models with your own key](https://docs.zelto.ai/docs/monitors.md#typesafe-models-with-your-own-key). | | **Deepgram** | Speech-to-text. Stored now for the upcoming Benchmarks; monitors don't use it. | You can store several keys for the same provider, for example one per team or environment. Each needs its own name. ## Add a key 1. Open **Settings → AI providers** and choose **Add key** on the provider. 2. Paste the key from your provider's dashboard. Optionally give it a name; it defaults to the provider name. 3. Choose **Save key**. Zelto checks the key with a no-cost call to the provider (such as listing its models) before saving it. A key the provider rejects is not saved, and if the provider can't be reached, nothing is saved and you can try again. The key is stored encrypted. After that, only its last four characters are ever shown, in the app, the API, and MCP. ## Test, rotate, rename, and remove * **Test** checks a saved key again and shows **Working** or **Check failed**. A failed key is reported, not removed. * **Rotate** replaces the secret. The new key is checked first, so a typo leaves the current key in place. Every monitor on the key switches to the new secret at once, because monitors reference the key rather than copying it. Leave the key field blank to only rename. * **Remove** deletes the key. It is refused while any monitor still runs on it, and the list of those monitors is shown: switch them to another key or the built-in model first. Adding, rotating, renaming, and removing a key each write an [audit log](https://docs.zelto.ai/docs/settings.md#audit-log) entry (`ai_key.created`, `ai_key.rotated`, `ai_key.renamed`, `ai_key.deleted`) with the provider, name, and last four characters. The secret is never logged. ## Use a key in a monitor In the monitor editor's model settings, pick the provider, then choose one of the organization's keys for it and enter the provider's own model ID (for example `gpt-5`, `claude-sonnet-4-5`, or `anthropic/claude-sonnet-4.5` on OpenRouter and the gateway). If there is no key yet for that provider, the editor links to this page. Choosing which key a monitor uses is owner/admin only. The **Try it** step uses the same key, so you can test a monitor on it before saving. See [Try it before enabling](https://docs.zelto.ai/docs/monitors.md#try-it-before-enabling). From the API, `PUT /v1/monitors/{id}/model` with `{ "aiKeyId": "…", "model": "gpt-5" }` puts a saved monitor on a key, and `{ "provider": "bedrock" }` (with an optional `modelTier`) moves it back to the built-in model. Over MCP the same change is `set_monitor_model`, and `test_monitor` with `aiKeyId` and `model` tries it first. Changing the provider or model starts a new monitor version and resets its alert; switching to another key of the same provider does not. ## Billing * **Your provider bills you directly** for the tokens used on your key. * That usage does **not** count toward your plan's monitor runs or monitor tokens. See [Plans, limits and retention](https://docs.zelto.ai/docs/plans.md). * Zelto charges a **bring-your-own platform fee** for running the pipeline, storage, and results around those calls: a percentage of the usage's estimated list-price cost. The default is **5%**; your agreement can set a different rate, including 0%. The fee appears on [Settings → Usage](https://docs.zelto.ai/docs/settings.md#usage) and as a line on your monthly usage invoice. The estimated list price is Zelto's estimate from published model prices (the OpenRouter and Vercel AI Gateway model catalogs, refreshed every few hours, plus published OpenAI, Anthropic and TypeSafe prices), not your provider's invoice. A model Zelto has no published price for (including models a catalog lists as free, and variable-price routers such as `openrouter/auto`) can't carry a percentage, so each call to it carries a small flat fee instead: $0.00001 at the default 5% rate ($0.01 per 1,000 calls, about 5% of a typical TypeSafe Jev call), scaled with your rate. ## PHI mode Organizations in PHI mode can't add or rotate keys: call content can't be sent to a third-party provider under your own key. If an organization with keys turns on PHI mode, those keys stop being used right away and can only be removed. The same applies to a key saved on an individual monitor before organization keys existed: monitors in a PHI-mode organization run only on Zelto's built-in models. ## API and MCP Everything on this page is also available programmatically, with the same checks and errors. Both need an owner or admin key. * **REST**: `GET`/`POST /v1/ai-keys`, `GET`/`PATCH`/`DELETE /v1/ai-keys/{id}`, `POST /v1/ai-keys/{id}/test`, and `PUT /v1/monitors/{id}/model`. See the [API reference](https://docs.zelto.ai/api-reference/agents/list-agents.md), under **AI providers**. * **MCP**: `list_ai_keys`, `create_ai_key`, `update_ai_key`, `test_ai_key`, `delete_ai_key`, `set_monitor_model`, and the `aiKeyId` and `model` inputs of `test_monitor`. See [AI provider keys](https://docs.zelto.ai/docs/mcp.md#ai-provider-keys) on the MCP page. When a person can paste the key, use the Settings page: over the API or MCP the secret passes through whatever script or agent sends it. ## Related * [Monitors](https://docs.zelto.ai/docs/monitors.md) — the judges that run on these keys. * [Settings](https://docs.zelto.ai/docs/settings.md) — usage, billing, and the audit log. * [MCP](https://docs.zelto.ai/docs/mcp.md) — manage keys from an AI client. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.