# AI Provider Keys

Manage the LLM provider keys (OpenAI, Gemini, or the built-in Foldspace key) your agents run on. These are provider credentials, not your Foldspace REST API key.

**Path:** Settings → AI Gateway → AI Provider Keys

AI Provider Keys are the LLM provider credentials your agents and task agents run on: your own OpenAI or Gemini key, or the built-in Foldspace key. Foldspace uses them to call the model on your behalf. A built-in Foldspace key ships by default, so everything works out of the box, and you can add your own key from a supported provider.

## The keys list

Each row is a key, with:

| Column | What it shows |
| :--- | :--- |
| **Name** / **Description** | Your label for the key. |
| **Provider** | The key's provider (**Foldspace** built-in, **OpenAI**, or **Gemini**). |
| **Usage** | The agents and task agents currently using this key. Open it to see the full list. |
| **Default** | A star marks the default key. |
| **Created By** / **Created Date** | Provenance. |

Foldspace includes a built-in **Foldspace** key (the "Default Foldspace Key") so new accounts have a working model immediately.

## Add a provider key

1. Click **Create**.

2. Fill in the key:

   | Field | Purpose |
   | :--- | :--- |
   | **Provider** | The LLM provider: **OpenAI** or **Gemini**. |
   | **Name** | A label for the key. |
   | **Description** | Optional note. |
   | **Secret Key** | The provider's secret API key. |
   | **Default** | When on, any new Agent or Task Agent automatically uses this key. |

3. Click **Test Connection** to verify the key reaches the provider, then **Create**.

## Add keys for high availability

Failover can only route to keys you've added. Add a key on **both** providers, one OpenAI and one Gemini, so that when one provider is throttled or down, Foldspace can cross to the other on your own key instead of falling straight back to the built-in Foldspace key. Adding a second key for the same provider also lets failover spread load across your keys. See [High Availability](/user-guides/high-availability/) for the full fallback order.

## The default key

The starred key is the default: **new agents and task agents automatically use it**. You can change which key is default at any time. To see exactly which agents and task agents a key powers, open its **Usage**: it lists every Agent and Task Agent (with links) bound to that key.

:::tip
To rotate a key, add the replacement and test its connection first, move the agents onto it (set it default, or reassign the agents shown in the old key's **Usage**), then delete the old key. Keep at least one healthy key live throughout, since failover routes across your keys.
:::

## Related

- [High Availability](/user-guides/high-availability/): how failover routes across your provider keys.
- [Token Quotas](/user-guides/quotas/): cap token spend per agent, user, and tier.
- [User Management](/user-guides/roles-permissions/): the **AI Provider Key** feature is one of the permissions you can grant per teammate.
- [Cost & tokens](/user-guides/analytics/cost-tokens/): track spend and token consumption per model and provider.