Cloud providers
Configure OpenAI, Anthropic, Gemini, Grok, Amazon Bedrock, and Google Vertex AI as LLM providers
Overview
MagOneAI supports major cloud LLM providers with native integration. Configure your API keys in the Admin Portal, and start using models immediately across your organization.
Cloud providers offer:
- No infrastructure management — pay per token, no servers to maintain
- Latest models — access to cutting-edge capabilities as they're released
- Scalability — handle any volume without capacity planning
- High availability — provider-managed uptime and redundancy
This guide covers OpenAI, Anthropic, and Google Gemini in full. The three newer providers have pages of their own, linked from the table below.
Choosing a provider
When you add an LLM configuration, the Provider picker shows seven options in two groups.
Direct APIs
You reach the model vendor's own API with a key from that vendor.
| Provider | Credential | Default endpoint | Guide |
|---|---|---|---|
| OpenAI | API key | https://api.openai.com/v1 | Below |
| Anthropic | API key | https://api.anthropic.com/v1 | Below |
| Gemini | Google AI Studio API key | https://generativelanguage.googleapis.com/v1beta | Below |
| Grok (xAI) | xAI API key | https://api.x.ai/v1 | Grok (xAI) |
Cloud and self-hosted
You reach a model through a cloud platform you already pay for, or through a server you run.
| Provider | Credential | Endpoint | Guide |
|---|---|---|---|
| Amazon Bedrock | AWS access key, secret key, optional session token, plus a region | Derived from the region | Amazon Bedrock |
| Google Vertex AI | GCP service account JSON, plus project ID and region | Derived from project and region | Google Vertex AI |
| Self Hosted | Whatever your server expects | You supply it, HTTPS required | Private models |
Seven provider tabs, five backend providers. OpenAI, Grok (xAI) and Self Hosted all talk to an OpenAI-compatible API, so MagOneAI stores all three with the same backend provider. The tab you picked is remembered separately, so the edit panel always re-opens on the right one.
Anthropic, Gemini, Amazon Bedrock and Google Vertex AI each have their own native implementation.
Azure OpenAI has no tab of its own. Configure it as OpenAI or Self Hosted and point the endpoint at your Azure deployment URL. See Azure OpenAI below.
OpenAI configuration
OpenAI provides the widely-used GPT family of models, including GPT-5, GPT-4o, and the reasoning-focused o-series.
GPT-5 — Current flagship reasoning model
- Function calling: Yes
- Structured output: Yes
- Best for: Complex multi-step reasoning, analysis that has to hold a long chain of logic together, hard code generation
GPT-5 mini — Smaller, faster GPT-5
- Function calling: Yes
- Structured output: Yes
- Best for: Reasoning work where full GPT-5 is more than the task needs
GPT-5 nano — Smallest of the GPT-5 family
- Function calling: Yes
- Structured output: Yes
- Best for: High-volume reasoning at the lowest cost in the family
GPT-4o — GPT-4 with vision, fast and capable
- Context: 128K tokens
- Vision: Yes
- Function calling: Yes
- Best for: General-purpose tasks, multimodal workflows, production deployments
GPT-4o-mini — Smaller, faster, cheaper version of GPT-4o
- Context: 128K tokens
- Vision: Yes
- Function calling: Yes
- Best for: Classification, routing, simple extraction, high-volume tasks
GPT-4 — Original GPT-4 (being phased out in favor of GPT-4o)
- Context: 8K or 32K tokens
- Vision: No (text-only)
- Function calling: Yes
- Best for: Legacy workflows, text-only tasks
o1 — Reasoning model with extended thinking capability
- Context: 128K tokens
- Vision: Limited
- Function calling: Yes
- Best for: Complex reasoning, mathematics, code generation, strategic analysis
o3-mini — Smaller reasoning model, faster than o1
- Context: 128K tokens
- Vision: No
- Function calling: Yes
- Best for: Reasoning tasks where o1 is overkill, cost-sensitive reasoning workflows
Also recognised as reasoning models: o1-mini, o1-preview, o3 and o4-mini. See Reasoning models for how the platform handles them.
Reasoning models
GPT-5 and the o-series behave differently from chat models at the API level, and MagOneAI handles the differences for you rather than making you configure around them.
temperatureandtop_pare stripped. OpenAI rejects both on reasoning models. The gateway removes them before the request goes out, so a config carrying them still works instead of erroring.max_tokensbecomesmax_completion_tokens. Renamed for every reasoning model, whether or not thinking is on, because these models require the newer field.- A minimum output budget is enforced when thinking is on. If
max_completion_tokensis unset or below 4096, it is raised to 4096. A reasoning model can otherwise spend its whole budget on the scratch pad and return nothing visible, so a tight cap fails silently rather than loudly. This means a configuredmax_tokensof 500 becomes 4096 in the request. - Thinking maps to
reasoning_effort. Settingthinking_enabledandthinking_efforton an agent translates to OpenAI'sreasoning_effortparameter. - Reasoning tokens are counted separately. These models report a
reasoning_tokensfigure alongside normal completion tokens, and the platform logs it. That is the quickest way to confirm the model actually spent effort thinking rather than answering straight away. - Prompt caching is accounted for. OpenAI reports cached input under
cached_tokens. Because OpenAI'sprompt_tokensalready includes the cached portion, input token counts are left as reported rather than double-counted.
Which models count as reasoning models is configurable per deployment via the OPENAI_REASONING_MODELS environment variable. The default covers gpt-5, gpt-5-mini, gpt-5-nano, o1, o1-mini, o1-preview, o3, o3-mini and o4-mini, so a newly released model can be added without a platform upgrade.
Setup steps
Obtain OpenAI API key
Sign up for an OpenAI account at platform.openai.com and create an API key. You'll need billing configured on your OpenAI account.
Add provider in Admin Portal
In the Admin Portal, add a new provider.
Select OpenAI-compatible as the provider type (this also covers Azure OpenAI and any OpenAI-compatible endpoint).
Enter API key
Paste your OpenAI API key. Click Store in Vault to securely save it in HashiCorp Vault.
You'll see a reference like vault:openai/api_key — the actual key is never displayed again.
Configure default settings (optional)
Set platform-wide defaults:
- Default organization ID (if using OpenAI org structure)
- Request timeout (default: 60 seconds)
- Retry settings (attempts and backoff)
Test connection
Click Test Connection. MagOneAI will make a test API call to verify:
- API key is valid
- Models are accessible
- Network connectivity is working
Assign to organizations
Choose which MagOneAI organizations can use OpenAI models. You can enable for all orgs or select specific ones.
Azure OpenAI
Azure OpenAI is configured as an OpenAI-compatible provider — there is no separate Azure provider type. Point the endpoint at your Azure deployment URL, including the ?api-version=... query string Azure requires:
https://mycompany.openai.azure.com/openai/deployments/gpt-4o?api-version=2024-02-15-previewMagOneAI preserves any query parameters already on the endpoint when it appends /chat/completions (and /models), so the api-version param survives every request rather than being silently dropped. Store the Azure key in Vault exactly like any other OpenAI-compatible key.
Function calling
All OpenAI models support native function calling. When you attach tools to an agent using an OpenAI model, MagOneAI automatically formats tool definitions in OpenAI's function calling format and processes tool calls from the model's responses.
Vision support
GPT-4o and GPT-4o-mini support vision. Send images as part of the input:
- Image URLs (must be publicly accessible or signed URLs)
- Base64-encoded images
- File uploads processed by MagOneAI
Against the native OpenAI API, MagOneAI can hand the model an image by URL directly, avoiding a re-download; when a direct URL isn't usable it falls back to sending the image inline as base64. Anthropic and Gemini always receive images as base64 — the gateway downloads any URL image first before calling those providers.
Vision models can:
- Extract text from documents (OCR)
- Understand charts and diagrams
- Answer questions about images
- Describe image content
Use vision models for document processing, visual QA, and multimodal workflows.
Cost considerations
Model pricing changes often enough that repeating it here would mislead more than it helps. Check OpenAI's pricing page for current rates, and set the real per-token cost on each model in its LLM Config so usage analytics reflect what you actually spend.
Optimization tips:
- Use GPT-4o-mini for simple tasks; it is substantially cheaper than GPT-4o
- Reach for a reasoning model only when the task genuinely needs extended thinking. Reasoning tokens are billed as output, so a model that thinks hard costs more than the response length suggests
- Within the GPT-5 family, step down to mini or nano before stepping outside it
Anthropic configuration
Anthropic provides the Claude family of models, known for their extended context windows and strong reasoning capabilities.
Claude Sonnet 4.5 — Latest flagship model with strong performance
- Context: 200K tokens (experimental 1M available)
- Vision: Yes
- Function calling: Yes (via "tool use")
- Best for: Production workloads, complex analysis, extended context tasks
Claude Opus 4.6 — Most capable Claude model
- Context: 200K tokens
- Vision: Yes
- Function calling: Yes
- Best for: Most complex reasoning, strategic analysis, nuanced understanding
Claude Haiku — Fast, lightweight Claude model
- Context: 200K tokens
- Vision: Yes (select versions)
- Function calling: Yes
- Best for: High-volume tasks, classification, fast response needs
Setup steps
Obtain Anthropic API key
Sign up for an Anthropic account at console.anthropic.com and create an API key. Configure billing on your account.
Add provider in Admin Portal
In the Admin Portal, add a new provider.
Select Anthropic as the provider type.
Enter API key
Paste your Anthropic API key. Click Store in Vault to securely save it in HashiCorp Vault.
Test connection
Click Test Connection to verify API access and model availability.
Assign to organizations
Choose which MagOneAI organizations can use Anthropic models.
Function calling via "tool use"
Anthropic models support function calling through their "tool use" feature. It works the same as OpenAI's function calling from an application perspective — models can call tools during reasoning.
Anthropic's tool use is often praised for:
- Accurate tool parameter generation
- Intelligent tool selection
- Strong reasoning about when tools are needed vs when to answer directly
Extended context windows
All Claude models support 200K token context windows, significantly larger than most other models. Some Claude models offer experimental 1M token context.
Use cases for extended context:
- Process entire codebases or long documents
- Maintain conversation history over many turns
- Include extensive reference materials in every request
- Avoid context summarization and loss of detail
Note: Extended context is powerful but expensive. Only include necessary context.
Cost considerations
Model pricing changes often enough that repeating it here would mislead more than it helps. Check Anthropic's current pricing, and set the real per-token cost on each model in its LLM Config so usage analytics reflect what you actually spend.
Optimization tips:
- Use Claude Haiku for simple tasks (much cheaper than Sonnet/Opus)
- Use Claude for extended context needs instead of multiple smaller requests
Google Gemini configuration
Google provides the Gemini family of models with strong multimodal capabilities and competitive pricing. MagOneAI integrates with Gemini natively using a Google AI Studio API key.
Gemini 2.0 Flash — Fast, lightweight model with multimodal support
- Context: 1M tokens
- Vision: Yes
- Function calling: Yes
- Best for: High-volume tasks, long context needs, cost-sensitive workloads
Gemini 2.5 Pro — Most capable Gemini model
- Context: 2M tokens (largest available)
- Vision: Yes
- Function calling: Yes
- Best for: Extremely long context, multimodal analysis, complex reasoning
Setup steps
Obtain Google AI Studio API key
Go to ai.google.dev and create a Google AI Studio API key.
Add provider in Admin Portal
In the Admin Portal, add a new provider.
Select Google Gemini as the provider type.
Enter API key
Paste your Google AI Studio API key. Click Store in Vault to save it securely.
Test connection
Click Test Connection to verify access and model availability.
Assign to organizations
Choose which MagOneAI organizations can use Google models.
Function calling
Gemini models support native function calling. Google's function calling implementation is compatible with OpenAI's format, making integration straightforward.
Multimodal capabilities
All Gemini models are natively multimodal, supporting:
- Text input and output
- Image understanding
- Audio understanding (select models)
- Video understanding (select models)
Gemini excels at:
- Document analysis with complex layouts
- Video content understanding
- Cross-modal reasoning (e.g., "Describe what's being said in this video")
Extended context — up to 2M tokens
Gemini 2.5 Pro supports 2 million token context, the largest available from any major provider. This enables:
- Processing entire books or documentation sets
- Analyzing hours of video content
- Maintaining extremely long conversation histories
- Including massive reference materials
Cost note: 2M tokens of context is expensive even at Google's pricing. Use extended context judiciously.
Cost considerations
Model pricing changes often enough that repeating it here would mislead more than it helps. Check Google's current pricing, and set the real per-token cost on each model in its LLM Config so usage analytics reflect what you actually spend.
Optimization tips:
- Use Gemini Flash for long-context tasks (very cheap compared to alternatives)
- Leverage native multimodal capabilities instead of separate OCR + LLM pipeline
- Use Gemini Pro when you need the 2M context window
API key management
All provider API keys are stored in HashiCorp Vault with military-grade security.
How API keys are stored
Encrypted at rest
API keys are encrypted with AES-256 before storage. Vault's encryption is FIPS 140-2 compliant.
Access control
Only the MagOneAI platform service account can read API keys. Individual users never have direct access to keys.
Audit logging
Every retrieval of an API key from Vault is logged with timestamp, requesting service, and reason.
Automatic rotation support
Vault supports automatic key rotation. Update the API key in Vault, and all services use the new key without configuration changes.
Key reference format
In configuration files and UI, API keys are referenced by Vault path, never stored directly:
vault:openai/api_key
vault:anthropic/production_key
vault:google/gemini_keyThis ensures:
- Keys never appear in logs
- Configuration files can be version-controlled safely
- Keys can be rotated without updating configurations
Rotation without disruption
To rotate an API key:
- Generate new key from provider (OpenAI, Anthropic, Google)
- Update the key in Vault at the existing path
- Existing workflows continue with no disruption
- (Optional) Revoke old key from provider after confirming new key works
No agent configurations or workflow definitions need updating.
Usage tracking and costs
Monitor model usage across all cloud providers in the analytics dashboards.
What's tracked
- Token usage — input tokens and output tokens per provider, org, and project
- Per-token cost — when you set input/output cost per 1k tokens on a model, usage analytics surface token-based cost
- Latency — response times by provider and model
Usage analytics
Usage and cost analytics appear in the analytics dashboards — see the Admin Portal.
View:
- Token usage over time — daily, weekly, monthly trends
- Usage by provider, organization, and project
- Per-token cost for models that have cost configured
Quotas
MagOneAI enforces token-based quotas (daily, weekly, and monthly) at the org, project, use-case, and user scope. When a quota is exceeded, requests are rejected with a clear error message until the quota resets or is increased.
Quotas are configured and managed on a dedicated surface — see Usage and quotas.
You can use multiple providers simultaneously. Use OpenAI for general tasks, Anthropic for complex reasoning with extended context, Google for multimodal, and Bedrock or Vertex AI where traffic has to stay inside your own cloud account. All within the same project. Mix and match to optimize cost and capability.
Best practices
Create separate API keys for development, staging, and production environments. This allows:
- Separate cost tracking
- Isolated quota management
- Easier debugging (know which environment caused issues)
- Security isolation (compromise in dev doesn't affect production)
Apply token-based quotas at the org, project, use-case, and user scope to:
- Prevent runaway usage from buggy workflows
- Ensure fair allocation across organizations
See Usage and quotas for configuration.
Regularly review model usage to identify:
- Agents using expensive models unnecessarily
- High-volume tasks that could use cheaper models
- Token-based cost trends across orgs and projects
Troubleshooting
Symptoms: "Invalid API key" or "Authentication failed" errors.
Solutions:
- Verify the API key is correct in the provider's console
- Check if the key has been revoked or expired
- Ensure billing is configured on the provider account
- Update the key in Vault and test connection again
Symptoms: "Rate limit exceeded" or "Too many requests" errors.
Solutions:
- Check if you're hitting the provider's own rate limits
- Reduce request frequency in workflows
- Upgrade to a higher-tier plan with the provider for higher limits
Symptoms: "Model not found" or "Model not available" errors.
Solutions:
- Verify the model name is correct (case-sensitive)
- Check if the model is available in your provider account tier
- Some models require waitlist access — check provider console
- Ensure the model hasn't been deprecated by the provider
Symptoms: Requests taking very long or timing out.
Solutions:
- Check provider status page for outages or degraded performance
- Reduce max tokens to decrease response generation time
- Consider using a faster model for time-sensitive tasks
- Increase timeout settings if legitimate requests are timing out
- Verify network connectivity to provider endpoints
Next steps
Amazon Bedrock
Connect models hosted on AWS with SigV4 credentials
Google Vertex AI
Connect Gemini in your own GCP project
Grok (xAI)
Connect xAI's Grok models with an API key
Model capabilities
Declare vision, audio, decision and thinking support
Private models
Deploy your own models for data sovereignty
Model configuration
Learn about model selection and optimization