Bring your own LLM
Use your own provider credentials, choose models by workload, and set clear cost boundaries.
1. Choose a provider and model
Pick a provider that meets your workload, data processing, retention, and regional requirements. A capable model for an incident investigator may differ from one used for extracting fields from a document.
During the pilot, agree the providers and model capabilities you need. Provider compatibility and private endpoint support must be verified during onboarding; an OpenAI-compatible endpoint alone does not guarantee equivalent behavior.
2. Create a scoped provider credential
Create a separate API project or service account for the workspace. Apply provider-side spending limits, resource restrictions, and appropriate access controls where supported. Keep personal developer keys separate from production credentials.
Give the credential to the platform administrator through the agreed secure secret-management process. Never submit API keys through the public quote form, email, a task description, or a chat prompt.
3. Configure a model connection
Associate a named model connection with a server-side secret reference. Record the endpoint, model identifier, owner, and relevant data handling requirements. For multiple providers, create separate connections with separate credentials and scopes.
The UI, CLI, and Terraform all configure the same model connections. Set the provider, endpoint, model identifier, owner, and credential reference. Keep separate connections for separate providers; assign them explicitly to the agents that should use them.
Before registering a provider, test its credentials directly. The following Python script sends one short, non-sensitive request to Anthropic and reports the selected model and token usage. It needs only Python’s standard library.
"""Send one non-sensitive probe using a server-side Anthropic credential."""
import json
import os
import sys
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen
def main() -> None:
key = os.environ["ANTHROPIC_API_KEY"]
model = os.environ["ANTHROPIC_MODEL"]
request = Request(
"https://api.anthropic.com/v1/messages",
data=json.dumps({"model": model, "max_tokens": 32,
"messages": [{"role": "user", "content": "Reply with OK."}]}).encode(),
headers={"Content-Type": "application/json", "x-api-key": key,
"anthropic-version": "2023-06-01"},
method="POST",
)
try:
with urlopen(request, timeout=30) as response:
result = json.load(response)
except HTTPError as error:
raise SystemExit(f"Provider returned HTTP {error.code}; check the key, model, and quota") from None
except (URLError, TimeoutError):
raise SystemExit("Provider connection failed or timed out") from None
print(json.dumps({"model": result["model"], "usage": result["usage"],
"text": [part["text"] for part in result["content"]
if part["type"] == "text"]}, indent=2))
if __name__ == "__main__":
try:
main()
except KeyError as error:
sys.exit(f"Set {error.args[0]} in the process environment before running")
Download the script, then run these commands in Bash. Enter the credential at the hidden prompt; choose a model enabled for your provider account. The request incurs provider usage.
read -rsp "Anthropic API key: " ANTHROPIC_API_KEY
export ANTHROPIC_API_KEY
export ANTHROPIC_MODEL="claude-sonnet-4-6"
python3 check_anthropic.py
unset ANTHROPIC_API_KEYA successful response includes a model identifier, a text response, and input/output token counts. The script exits with a useful error on an HTTP failure or timeout without printing the key. See the Anthropic Messages API reference.
Verify a self-hosted model with Ollama
With Ollama running locally, choose an installed model fromollama list, export its exact name as OLLAMA_MODEL, and run the downloaded script withbash check_ollama.sh. It calls the local chat endpoint with streaming disabled and an output limit of 32 tokens.
#!/usr/bin/env bash
set -euo pipefail
: "${OLLAMA_MODEL:?Set OLLAMA_MODEL to a model installed on your Ollama server}"
python3 - "$OLLAMA_MODEL" <<'PY' | curl \
--fail-with-body --silent --show-error --max-time 120 \
http://localhost:11434/api/chat \
--header 'Content-Type: application/json' --data-binary @-
import json
import sys
json.dump({"model": sys.argv[1], "stream": False,
"messages": [{"role": "user", "content": "Reply with OK."}],
"options": {"num_predict": 32}}, sys.stdout)
PY
See the Ollama chat API reference. A hosted Entergenie runner must have network access to your model server; localhost in that runner refers to the runner itself. Register a reachable, authenticated endpoint for a remote model.
4. Verify the whole path
- Confirm that the provider connection authenticates and uses the intended model.
- Run a synthetic task using non-sensitive data.
- Verify tool calling, output handling, usage reporting, timeouts, and errors.
- Test provider failure and rate limits. Stop or retry within the task policy.
- Check that credentials do not appear in logs, transcripts, or results.
- Confirm provider-side spend monitoring and the task’s own cost ceiling.
5. Route deliberately, rotate routinely
Assign models by agent or workload. Do not silently route to a different provider: a fallback may change data location, processing terms, capability, and cost. Approve fallback providers explicitly and re-evaluate representative tasks before switching.
Rotate keys through the secret store and test revocation. Prefer model identifiers and connection references in portable configuration so the rest of your workflow can survive a provider change.
Understand the two bills
Entergenie platform fees cover the agreed platform scope. Model usage is billed separately by your LLM provider. A task budget and provider-side cap are complementary controls; they should not be described as a guarantee against all billing overruns without verifying provider behavior.
View plans and pricing or discuss your provider requirements.