OKMOneKeyModelsUniversal OpenAI-compatible gateway
DocsLog inSign up

Runtime access

Access policy

Settings is where access, credentials, and policy live. Keep it separate from the model catalog itself.

Tenant
No tenant selectedSelect a workspace first
Current plan signal
standardShown beside the live entitlement payload for comparison
Provider credential status
Backend credential rows have not been loaded yet, so the portal falls back to the scaffold.Fallback
OpenAI provider credential slot

Add a tenant-owned OpenAI API key for byok/openai/* routes.

placeholder
Display labelAPI keyOptional project label

Portal fallback: the live credential rows are shown in the dashboard when the backend surface is reachable.

Anthropic provider credential slot

Store an Anthropic key for byok/anthropic/* routes.

placeholder
Display labelAPI keyOptional workspace name

Keep this isolated from pooled tiers; no fallback to cheap/*.

Gemini provider credential slot

Reserved for future tenant-managed Gemini routing.

not-configured
Display labelAPI keyProject identifier

Intentionally scaffolded in the portal before the backend adapter lands.

GLM / Z.AI provider credential slot

Reserved for future tenant-managed GLM routing.

not-configured
Display labelAPI keyRegion notes

This section is visible so the UX contract is ready before the backend integration.

Plan signal
standardPortal defaults until live entitlement payload loads
cheap/*

Pooled inference is available in the default portal contract.

enabled
OpenAI-compatible /v1/*Sticky thread affinityStrict scrub mode

Models: cheap/gpt-5.4, cheap/claude-sonnet, cheap/longctx

resale/*

Official-provider pass-through is available to this tenant.

enabled
Provider-native cost basisOpenAI-compatible APINo pooled fallback

Models: resale/gpt-5.4, resale/claude-sonnet

byok/*

BYOK is visible in the portal contract and becomes active once tenant provider credentials are configured.

needs-credentials
Tenant provider credentialsKey maskingUsage logging

Models: byok/openai/gpt-5.4, byok/anthropic/claude-sonnet

Operator guardrails

Policy & risk

Keep pooled-route caveats visible, but secondary to the actual access state on the left.

criticalPooled mode keeps strict scrub on by default

Cheap/* traffic is routed through pooled accounts. Keep secrets, tokens, and personal data out of those requests unless you explicitly accept the pooled-mode caveats.

Review scrub policy
warnHistory cleanup is an operator workflow, not a guarantee

The portal exposes the cleanup story as an operator workflow, but pooled requests can still be visible in the shared account history. Treat them as non-dedicated traffic.

Read the privacy notes
infoBYOK data stays tenant-scoped

BYOK routes should never use pooled fallbacks. The live portal keeps tenant provider credentials masked and tenant-scoped.

Configure provider keys