Scenario Organization Provided API Keys

Goal: Your organization pays for the use of AI models. Your colleagues get ready-made providers, including their API keys, without ever handling a key themselves.

You need: API keys of your providers, an encryption secret, and a way to deploy it to every device.

Building blocks

What	How
Providers with keys	Provider entries with APIKey, encrypted
Devices can decrypt the keys	The encryption secret on every device
Older devices keep working	The compatible format ENC:v1: until every device runs v26.10.1
No other providers	Optionally lock adding and importing providers

Step by step

1. Create the secret. In AI Studio, switch on "Settings" → "App Options" → "Show administration settings?", then click "Generate an encryption secret and copy it to the clipboard" in the "Enterprise Administration" section.

2. Deploy the secret to every device, and to your own:

   • Windows: the registry value config_encryption_secret, through a group policy, see Deploying on Windows;
   • Linux and macOS: the policy file config_encryption_secret.yaml, see Deploying on Linux and Deploying on macOS.

   The "Information" page shows whether a device has a secret.

3. Choose the format of your exports, in "Enterprise Administration" → "Format for encrypted secrets in exports": keep the compatible format until every device runs AI Studio v26.10.1 or newer.

4. Set up each provider in AI Studio with its key, and export it with the key. AI Studio writes the key encrypted.

5. Paste the fragments into your configuration and roll it out.

The configuration

CONFIG = {}

CONFIG["LLM_PROVIDERS"] = {}
CONFIG["LLM_PROVIDERS"][#CONFIG["LLM_PROVIDERS"]+1] = {
    ["Id"] = "9e1a8f3d-7c9b-4a6f-8d0e-2f3a4b5c6d7e",
    ["InstanceName"] = "Language model of Example Organization",
    ["UsedLLMProvider"] = "<PROVIDER_KEY>",
    ["Host"] = "NONE",
    ["Hostname"] = "",
    ["APIKey"] = "ENC:v1:<the encrypted key from your export>",
    ["AdditionalJsonApiParameters"] = "",
    ["Model"] = {
        ["Id"] = "<model ID>",
        ["DisplayName"] = "<model name>",
    },
}

CONFIG["SETTINGS"] = {}

-- Every administrator exports in the compatible format until all devices run v26.10.1:
CONFIG["SETTINGS"]["DataApp.EnterpriseEncryptionExportFormat"] = "V1"

-- Optional: no other providers.
CONFIG["SETTINGS"]["DataApp.AllowUserToAddProvider"] = false
CONFIG["SETTINGS"]["DataApp.AllowUserToImportConfigurationSnippets"] = false

CONFIG["SETTINGS"]["DataApp.PreselectedProvider"] = "9e1a8f3d-7c9b-4a6f-8d0e-2f3a4b5c6d7e"

Keep the keys in check

The encryption hides the keys, it doesn't make them secret. Users with administrator rights on their device can find a decrypted key with enough effort. So:

• Limit each key at the provider, for example, with a budget or a rate limit.
• Use separate keys per department or per configuration, so that you can revoke one without affecting everybody.
• Consider an internal AI gateway that holds the real keys of the providers and gives each department a key of its own, see Internal AI Gateway.

Changing the secret or a key

• A new key: export the provider again with the new key, and roll out the new configuration. Keep the Id of the provider.
• A new secret: when the secret on a device changes, AI Studio removes the keys of your configurations from the credential store, because they were encrypted with the old secret. Export every key again with the new secret, and deploy the new secret and the new configuration at the same time. Keys that users entered themselves stay.
• Switching to the protected format: once every device runs v26.10.1 or newer, set DataApp.EnterpriseEncryptionExportFormat to "V2", export the keys again, and replace them in your configuration.

Check it

1. On a test device with the secret, stage the configuration, see Testing and Exporting Configurations.
2. The provider appears with a lock, and a chat with it works.
3. On a device without the secret, the provider has no key, and the log reports that AI Studio couldn't decrypt it.

Where to go next

• Configuration Scenarios
• Providers and API Keys