By default every workspace answers on BeforeQuery’s own provider keys. Point a workspace at your provider account instead and inference is billed to you, runs under your data agreements, and can target a model or endpoint we don’t offer. Configure it under Workspace → Settings → Model.
This is a self-hosting and enterprise feature. If the deployment has no encryption key configured, the endpoints return 501 — every workspace simply keeps answering on the deployment’s keys, exactly as before. It isn’t broken; the feature is unavailable.

​
Set a provider

Reading the settings back returns has_api_key — a boolean — never the key itself.

​
Test before you save

Makes one small live call and reports the result. Omit api_key to test the credential already stored, rather than re-sending it.

​
Clear it

Reverts the workspace to the deployment’s model and keys.

​
Which model answers a question

Resolution runs in this order:
  1. The knowledge base’s own llm_provider / llm_model, if set
  2. The workspace’s llm_settings
  3. The deployment’s configuration
The credential lives at workspace level — one provider account per customer — while the per-knowledge-base columns choose which model runs on it. So you can bill everything to one account and still let a code-heavy knowledge base answer on a stronger model.
A question spanning several knowledge bases ignores the per-knowledge-base override, because there’s no principled way to pick between two configured models. It uses the workspace setting.

​
What routes through your account

Routed: streaming chat, multi-knowledge-base chat, the Slack / Discord / Teams bots, and form deflection including its verification pass. Not routed: query planning and LLM reranking, which retrieval owns separately. If your deployment reranks with the chat model rather than a hosted cross-encoder, that stage — the most expensive one per query — is still billed to the deployment rather than to you.

​
Private and self-hosted endpoints

base_url accepts any OpenAI-compatible endpoint, which covers Azure OpenAI, OpenRouter, vLLM, and Ollama.
The URL is validated as an SSRF sink: https and public addresses only. Pointing it at a private or loopback address is refused unless the operator has set security.allowPrivateLLMEndpoints, which a self-hosted deployment running Ollama on the same network will need.

​
Models offered in the dashboard

The dashboard lists these per provider. base_url lets you name any other model your endpoint serves.

​
API

Only workspace owners and admins can change these — see Roles & Permissions.