# LLM providers

> Connect PentAGI to built-in providers such as OpenAI, Anthropic, Gemini, Bedrock and Ollama, or to any OpenAI-compatible endpoint, with failover.

PentAGI needs at least one language model [provider](https://pentagi.com/docs/glossary/#provider). Credentials are set on the server in `.env`; each [flow](https://pentagi.com/docs/glossary/#flow) then picks the provider it runs on, and every [agent type](https://pentagi.com/docs/glossary/#agent-type) can use its own model settings.

## [Built-in providers](https://pentagi.com/docs/configuration/llm-providers/#built-in-providers)

| Provider             | Key variable                                                   | Endpoint override      |
| -------------------- | -------------------------------------------------------------- | ---------------------- |
| OpenAI               | `OPEN_AI_KEY`                                                  | `OPEN_AI_SERVER_URL`   |
| Anthropic            | `ANTHROPIC_API_KEY`                                            | `ANTHROPIC_SERVER_URL` |
| Google AI (Gemini)   | `GEMINI_API_KEY`                                               | `GEMINI_SERVER_URL`    |
| AWS Bedrock          | `BEDROCK_REGION` + one auth method                             | `BEDROCK_SERVER_URL`   |
| Ollama               | `OLLAMA_SERVER_URL` (`OLLAMA_SERVER_API_KEY` for Ollama Cloud) | —                      |
| DeepSeek             | `DEEPSEEK_API_KEY`                                             | `DEEPSEEK_SERVER_URL`  |
| GLM (Zhipu AI)       | `GLM_API_KEY`                                                  | `GLM_SERVER_URL`       |
| Kimi (Moonshot AI)   | `KIMI_API_KEY`                                                 | `KIMI_SERVER_URL`      |
| Qwen (Alibaba Cloud) | `QWEN_API_KEY`                                                 | `QWEN_SERVER_URL`      |
| MiniMax              | `MINIMAX_API_KEY`                                              | `MINIMAX_SERVER_URL`   |
| Mistral              | `MISTRAL_API_KEY`                                              | `MISTRAL_SERVER_URL`   |
| xAI (Grok)           | `XAI_API_KEY`                                                  | `XAI_SERVER_URL`       |

### [AWS Bedrock authentication](https://pentagi.com/docs/configuration/llm-providers/#aws-bedrock-authentication)

Set `BEDROCK_REGION` and choose one method:

```bash
BEDROCK_DEFAULT_AUTH=true          # AWS SDK default credential chain (EC2/ECS roles)
# BEDROCK_BEARER_TOKEN=...         # bearer token
# BEDROCK_ACCESS_KEY_ID=...        # static credentials
# BEDROCK_SECRET_ACCESS_KEY=...
```

### [Anthropic without a long-lived key](https://pentagi.com/docs/configuration/llm-providers/#anthropic-without-a-long-lived-key)

Instead of `ANTHROPIC_API_KEY`, Anthropic can be used with Workload Identity Federation through `ANTHROPIC_FEDERATION_RULE_ID`, `ANTHROPIC_ORGANIZATION_ID`, `ANTHROPIC_SERVICE_ACCOUNT_ID` and an identity token (`ANTHROPIC_IDENTITY_TOKEN` or `ANTHROPIC_IDENTITY_TOKEN_FILE`).

## [Custom and OpenAI-compatible endpoints](https://pentagi.com/docs/configuration/llm-providers/#custom-and-openai-compatible-endpoints)

Any OpenAI-compatible API — vLLM, LiteLLM, OpenRouter, DeepInfra, Atlas Cloud, the OpenCode Go plan or an Azure OpenAI deployment — is connected as the custom provider:

```bash
LLM_SERVER_URL=https://your-endpoint/v1
LLM_SERVER_KEY=your_key
LLM_SERVER_MODEL=model-name
LLM_SERVER_CONFIG_PATH=/opt/pentagi/conf/custom.provider.yml
```

`LLM_SERVER_KEY` is required: for a server without authentication, such as vLLM by default, set any non-empty value — with an empty key the custom provider is disabled. `LLM_SERVER_API_TYPE=azure` switches the custom provider to Azure OpenAI. A provider config file lets you assign a model and parameters per agent type; start from `examples/configs/custom-openai.provider.yml` in the repository and replace its `o3-mini`, which OpenAI retires on 23 October 2026.

![Configured providers in Settings → Providers](https://pentagi.com/images/product/settings-providers.webp)

## [Failover](https://pentagi.com/docs/configuration/llm-providers/#failover)

`LLM_FALLBACK_PROVIDER` names a second provider: a built-in one with credentials in `.env`, such as `anthropic`, or a provider the flow's owner saved in **Settings → Providers**. A model call that fails is repeated once on it and the switch is recorded in the trace; the next call starts on the flow's own provider again.

## [Choosing models](https://pentagi.com/docs/configuration/llm-providers/#choosing-models)

* Use your strongest model for `primary_agent`, `pentester` and `adviser`; lighter models work for `searcher`, `enricher` and summarization.
* For open models under 32B parameters, enable [execution monitoring and task planning](https://pentagi.com/docs/concepts/agents/#safeguards).
* **Settings → Providers** holds the provider profiles you create on top of the configured types — **Create Provider** offers only the types with credentials in `.env` — and the profile form tests a configuration before you save it.