Use your own model keys
Connect your own LLMGateway, OpenAI, Anthropic, or OpenRouter key so Veriom's agents run on your account and use no processing units.
This page is for a workspace Admin who wants Veriom's AI agents to run on the company's own model account. By default every agent runs on Veriom's platform models and uses processing units. With your own key, the provider bills you and Veriom uses no processing units for those calls.
Before you start
- You have the Admin or Owner role.
- You have an API key from one of these providers:
| Provider | Key looks like | Notes |
|---|---|---|
| LLMGateway | llmgtwy_... | Development keys (llmgdev_...) are refused in production |
| OpenAI | sk-proj-... or sk-svcacct-... | Admin keys (sk-admin-...) are refused. An EU endpoint is available |
| Anthropic | sk-ant-... | Admin keys are refused |
| OpenRouter | sk-or-... | |
| OpenAI-compatible endpoint | Any | Enterprise plan only. Needs an HTTPS address |
Connect a key
- Open Settings and select AI models.
- Click Connect and paste the key. Veriom recognizes the provider from the key's shape.
- Click Check and save and confirm your identity.
Veriom checks the key with the provider and lists its models. The key is encrypted when saved and never shown again.
Route agents to your models
Veriom groups its agents into reasoning tiers. Under Model routing, choose a ready model from your key for each tier, then click Activate routing policy.
A model must be qualified by Veriom before agents can use it. Models still waiting show Awaiting operator qualification. Click Request qualification to ask for one.
Tiers you do not route keep running on Veriom's platform models.
Veriom's platform models
Veriom names its platform models by the work they do. Model settings, audit detail and the activity log show these names:
| Veriom model | What it does |
|---|---|
| Veriom/Security-Lite | Fast work: routing questions, formatting answers and checking cited evidence |
| Veriom/Security-I | Deep reasoning: security review, impact analysis, remediation and Ask |
| Veriom/Security-Max | The highest-depth tier, reserved for explicitly approved decisions. No agent runs on it by default |
| Veriom/Architect-I | Architecture work: rebuilding components, relationships and trust boundaries, and writing the architecture narrative |
| Veriom/Index-I | Evidence indexing for code and evidence search |
Models on your own key keep the names your provider gives them in model settings and audit detail. The activity log can show the Veriom name instead for some agent runs.
What changes when you use your own key
- The provider bills you for those calls. They use no processing units.
- OpenAI calls are sent with storage turned off (
store=false). OpenRouter calls are sent with data collection denied. - If your workspace has a spend cap for your own keys, agent work on them stops with
customer_spend_cap_reachedonce the cap is reached.
Replace or remove a key
To replace a key, paste the new one with Paste the new key on the connected key. To remove it, revoke it from the list of connected keys. Tiers that used it need another model.
If something goes wrong
| Code | What it means | Fix |
|---|---|---|
invalid_key | The provider rejected the key | Copy the key again from the provider |
admin_key_rejected | It is an admin key | Create a normal project or service key |
insufficient_permissions | The key cannot list or call models | Give the key model access in the provider's console |
quota_exhausted | The provider account has no credit left | Add credit with the provider |
provider_unreachable | The provider did not answer | Try again in 30 seconds |
plan_not_allowed | This provider type is not on your plan | OpenAI-compatible endpoints need Enterprise |
Was this guide useful?
Your response stays in this browser unless you open a GitHub issue.Plans, billing and processing units
Compare Veriom's Free Trial, Starter, Growth, and Enterprise plans, understand processing units, and upgrade, apply a coupon, top up, or cancel.
Activity log and SIEM streaming
See every change in a Veriom workspace, export it as CSV, and stream it to your SIEM or another HTTPS endpoint.