Models and Providers

A Provider is a tenant-owned saved credential and endpoint configuration. It is separate from an Agent's model string: providerId chooses the credentials and client implementation, while model is passed to that Provider.

Choose platform credentials or your own Provider

BYOK is opt-in per Agent. A saved Provider can be assigned only to an Agent in the same Tenant.

How model selection works

The model ID must contain a /, but Blazing Agents otherwise passes it through without parsing it to choose a Provider. The selected Provider must support that model. With providerId: null, the platform uses OpenRouter; with an explicit Provider, its providerType selects the client implementation.

Test and assign a Provider

Test an unsaved configuration before storing it, then assign the saved Provider through an Agent update:

import { BlazingAgents } from "@blazing-agents/sdk";

const client = new BlazingAgents({
  apiKey: process.env.BLAZING_AGENTS_API_KEY!,
});
const apiKey = process.env.OPENROUTER_API_KEY;
if (!apiKey) throw new Error("OPENROUTER_API_KEY is required");

const test = await client.providers.test({
  providerType: "openrouter",
  apiKey,
  model: "deepseek/deepseek-v4-flash",
});
if (!test.ok) throw new Error(test.error.message);

const provider = await client.providers.create({
  name: "Production OpenRouter",
  providerType: "openrouter",
  baseUrl: null,
  apiKey,
});
const agent = await client.agents.update(process.env.AGENT_ID!, {
  providerId: provider.id,
  model: "deepseek/deepseek-v4-flash",
});

console.log(provider.keyFragment);
if (agent.providerId !== provider.id) throw new Error("Assignment failed");

Both test and testStored run a minimal live model request. They return { ok: true, latencyMs } or { ok: false, error: { code, message } }; a completed failed test still uses this result contract, so inspect ok.

Supported Provider configurations

Provider names are unique per Tenant and at most 80 characters. name and baseUrl are mutable; providerType and the API key are immutable. Read responses contain only id, name, providerType, baseUrl, keyFragment, createdAt, and updatedAt.

Secrets, rotation, and failure behavior

API keys remain server-side, are encrypted in storage, and are write-only. Neither list nor get returns a key, Tenant ID, or internal secret pointer. The Sandbox never receives Provider credentials.

Rotate a key by creating and testing a new Provider, updating every referencing Agent, and then deleting the old Provider. Deleting a Provider still referenced by an Agent is rejected. A model or credential failure during a Turn surfaces as provider_error from the upstream model path.

See Security and credentials for the wider credential boundary and Agents for assignment behavior.

Related guides

Follow Bring your own Provider for the complete rotation and verification workflow.

Reference

See the Providers TypeScript SDK Reference, Agent update, Providers REST API Reference, and Update Agent endpoint. Return to Configure your Agent for related topics.