Providers
The language model behind the assistant, and proxies
Select the provider on the settings page. This fills in the base URL, the authentication and the API version, all of which remain editable. Empty fields fall back to the provider’s defaults.
| Provider | Protocol | Base URL (default) | Key sent as |
|---|---|---|---|
| Anthropic | Anthropic | https://api.anthropic.com | x-api-key |
| OpenAI | OpenAI | https://api.openai.com/v1 | Authorization: Bearer |
| Azure OpenAI | OpenAI | required: https://<resource>.openai.azure.com/openai/deployments/<deployment> | api-key, API version 2024-10-21 |
| Google Gemini | OpenAI | https://generativelanguage.googleapis.com/v1beta/openai | Bearer |
| xAI Grok | OpenAI | https://api.x.ai/v1 | Bearer |
| Mistral | OpenAI | https://api.mistral.ai/v1 | Bearer |
| DeepSeek | OpenAI | https://api.deepseek.com/v1 | Bearer |
| Groq | OpenAI | https://api.groq.com/openai/v1 | Bearer |
| OpenRouter | OpenAI | https://openrouter.ai/api/v1 | Bearer |
| Ollama | OpenAI | http://localhost:11434/v1 | none |
| Other OpenAI-compatible (LiteLLM, a gateway, vLLM, LM Studio, …) | OpenAI | required, usually ending in /v1 | Bearer |
The model ID is the one the provider or proxy uses (claude-opus-5-5, gpt-5, llama3.3, …). The assistant requires a model that supports tool calling; support varies among small local models.
For local servers and proxies that need no key, a base URL alone is enough; no authorization header is sent.
The API key
The key comes from a credential, so it is stored and rotated like every other secret:
- Create a credential of type api under Settings > Connections > Credentials (see Credentials), with the key as its password. It can also read the key from a secret store.
- Choose it in the Credential field of the chat settings. The key is read for every message, so a changed password applies to the next message.
A key saved on the settings page before credentials existed keeps working while no credential is chosen. The config seed sets the key itself, as api_key.
For a proxy
A proxy or gateway in front of the model may need these settings:
- Authentication - how the key is sent:
Authorization: Bearer,api-key,x-api-key, or none. Empty uses the provider’s default. - API version - the
anthropic-versionheader, or?api-version=in the URL for OpenAI-compatible (Azure). - User - sent with every call as
user(OpenAI-compatible) ormetadata.user_id(Anthropic). Some proxies require it. Empty sends nothing. - Ignore certificate errors - insecure; trust the proxy’s CA with
NODE_EXTRA_CA_CERTSinstead. - Extra headers - a JSON object, e.g.
{"X-Org": "ops"}. One-line text values, at most 20; the key and content headers cannot be replaced.
In a container, behind a proxy
The chat uses plain outbound HTTPS from the AnsibleForms server container. Behind a corporate egress proxy, set HTTPS_PROXY and NODE_USE_ENV_PROXY=1; without the second, Node’s built-in HTTP client ignores HTTPS_PROXY. A provider with a certificate from an internal CA requires Node to trust that CA (NODE_EXTRA_CA_CERTS=/path/to/ca.pem). With NODE_USE_ENV_PROXY=1, a model or proxy inside the network must be listed in NO_PROXY, or the call goes to the egress proxy, which cannot reach it.
A failed connection test names the host and the reason (DNS, refused connection or untrusted certificate).