Skip to main content
Braintrust manages AI provider credentials on a single AI providers settings page. Configured providers are available in playgrounds, experiments, and the gateway without users needing individual API keys. The page has two sections:
  • Organization AI providers: defaults available across every project in the organization.
  • Project AI providers: overrides for the currently selected project.
Each row shows a redacted preview of the key (for example, abc...xyz) and a Last updated timestamp that tracks when the key value itself was last changed, along with the user who made the change. Renaming a provider or editing other metadata does not bump this timestamp. Keys that have not been rotated in over six months display a warning indicator. Braintrust recommends disabling and rotating AI provider secrets periodically.

​
Add an organization-level provider

Organization-level keys serve as defaults across all projects in the organization.
  1. Go to Settings > AI providers.
  2. Under Organization AI providers, click Organization provider and choose the provider you want to configure.
  3. Enter your API key for that provider.
  4. Click Save.
For provider-specific configuration (authentication methods, regions, model registries), see the AI provider integrations.

​
Authentication methods

Most providers authenticate with a long-lived API key. Some also support alternatives that avoid storing a long-lived provider credential in Braintrust:
  • Workload identity federation: Braintrust exchanges a short-lived, Braintrust-signed OIDC token for a provider access token at request time, so no long-lived key is stored. Available for OpenAI, Anthropic, Google Vertex AI, and Azure AI Foundry, for organization-level providers on Braintrust-hosted organizations with the gateway enabled.
  • Cloud-native role assumption: Bedrock supports AWS AssumeRole instead of storing long-lived access keys.
See each provider’s integration page for setup details.

​
Add a project-level provider

Use a project-level provider when:
  • Different projects need separate billing or rate limits.
  • You want to isolate API usage by project.
  • Projects require different provider accounts or credentials.
  1. Go to your project.
  2. Go to Settings > AI providers.
  3. Under Project AI providers, click Project provider and choose the provider you want to configure.
  4. Enter your API key for that provider.
  5. Click Save.
You can also add a project-level provider inline from playgrounds within that project. When you attempt to run a playground without a configured provider, you’ll see an option to add your API key without leaving the page.

​
How project overrides work

When a project-level provider has the same provider type (or, for custom providers, the same name — case-sensitive) as an organization-level provider, the project-level entry takes precedence for that project. An Overridden badge appears on the organization-level row to make the precedence explicit. Common use cases:
  • Regional endpoints (for example, US-specific OpenAI keys for a project that must keep traffic in-region).
  • Project-specific credentials that override an org-wide default.
  • Different model deployments for different teams sharing one organization.

​
Custom providers

Braintrust supports custom AI providers at both the organization and project level. Add them from the same Organization provider or Project provider picker. See Custom providers for endpoint configuration, headers, streaming, and cost metadata.

​
Permissions and access

Visibility of the two sections depends on the role of the signed-in user:
  • Organization admins see both Organization AI providers and Project AI providers.
  • Project admins with only the project-level Update permission see just Project AI providers.
  • Project members without Update don’t see the Project AI providers section at all.
Adding or modifying a project-level provider requires the Update permission, which governs modifying project resources in general. To keep all LLM traffic on approved organization-configured providers (for example, Bedrock) and prevent project users from adding their own keys:
  1. In your project, go to Settings > Project permissions.
  2. Remove the Update permission from non-admin users or their permission groups. Without Update, they can’t add or modify project-level AI providers.
  3. To preserve normal project work, create a permission group that grants Read, Create, and Delete but not Update, then assign those users to it.
For everything Update controls, see What Update covers. Removing Update doesn’t cut off access to organization-level providers. Those stay available to every user for playgrounds, experiments, and the gateway, regardless of project permissions.
API keys are stored as one-way cryptographic hashes, never in plaintext.

​
Manage built-in models

Topics use a family of Braintrust-served models (brain-*) for facet summarization, embeddings, and cluster naming. Braintrust hosts these models on Baseten, which is included in the Braintrust DPA as a subprocessor. For Braintrust-hosted (SaaS) organizations, built-in models are enabled by default. For self-hosted organizations, built-in models are disabled by default so that no trace data leaves your network boundary. Self-hosted organizations must enable built-in models to use Topics. To enable or disable built-in models:
  1. Go to Settings > AI providers.
  2. Under Built-in models, turn Allow built-in models on or off.
Loop is unaffected by this setting. Its chat models always come from your configured AI providers.
Disabling built-in models automatically pauses your topic automations. Re-enabling built-in models does not automatically resume them. You must resume each automation manually.
Only members of the Owners permission group, or a custom permission group with the Manage settings organization permission, can enable or disable built-in models.

​
GLM-5.2

GLM-5.2 is available for a limited time, through July 31, 2026.
GLM-5.2 is an open-source reasoning model, accessible from Braintrust without configuring your own AI provider. It’s available to Braintrust-hosted organizations (not self-hosted), but only when Settings > AI providers > Allow built-in models is enabled (this setting is enabled by default for Braintrust-hosted organizations). In playgrounds, prompts, and scorers, you can select GLM-5.2 from the Braintrust provider. When your organization has no AI providers configured, it’s selected by default. You can also call GLM-5.2 through the gateway by requesting model glm-5.2. On Starter and Pro plans, GLM-5.2 usage draws down your monthly credit, shared with Topics, at $1.40 per million input tokens, $4.40 per million output tokens, and $0.26 per million cached input tokens. On Starter, GLM-5.2 becomes unavailable once you use up the credit, until you enable on-demand usage or upgrade to Pro. Pro and on-demand usage continue at the same rates beyond the credit.

​
Next steps