AI providers
Bring-your-own-key LLM credentials for the whole organization, and how to choose between providers.
AI Providers is org-admin only. One credential set per provider, shared organization-wide and pulled down by every desktop install.
Nothing in Triagic investigates without one of these configured.
The providers
| Provider | Credentials | Embeddings | Typical default models |
|---|---|---|---|
| Azure OpenAI | Endpoint, API key, deployment, API version | Yes | gpt-5.5 |
| OpenAI | API key | Yes | gpt-5.5, gpt-5.5-mini |
| Anthropic | API key | No | claude-sonnet-5, claude-opus-5 |
| Google (Gemini) | API key | Yes | gemini-2.5-pro, gemini-2.5-flash |
| OpenRouter | API key | No | openai/gpt-5.5, anthropic/claude-sonnet-5 |
| Ollama | Host (defaults to http://localhost:11434) | Yes | llama3.3:70b |
Embedding support is not optional in practice
Similar-ticket search is a vector search over past investigations, and it needs embeddings. Without an embedding-capable provider it degrades gracefully rather than failing — but you lose one of the things that makes Triagic improve with use. If your preferred chat provider has no embeddings, configure a second provider that does.
Azure OpenAI specifics
The deployment field is the deployment name on your Azure resource, not a
canonical model id — against the Foundry surface, the API's model field carries the
deployment name. Prune your model registry to deployments that actually exist on your
resource; an override for a model that is not in the registry falls through rather
than failing.
Ollama specifics
Ollama runs on the member's machine, not here. The host you configure is resolved
locally by each desktop install, so http://localhost:11434 means each member's own
Ollama. This is the only provider where a shared configuration does not mean a shared
endpoint.
Secrets and validation
Saved keys come back masked as •••. Saving with the mask untouched keeps the stored
value; typing over it replaces it.
The portal does not test-call a provider — there is no long-lived process here to make the round trip from. Cards show:
Validated by your desktop app after sync.
A wrong key surfaces the first time an investigation runs on a member's machine. If runs start failing right after a credential change, that is the first place to look.
Choosing a model, and where
This page holds credentials. Which model is actually used is decided on the desktop:
- A per-thread override picked in the Console composer.
- The install's runtime default, set on the Usage page.
- The configured fallback.
Background triage and the playbook classifier always follow the runtime default and never a per-thread override.
Cost control
Model choice is the biggest lever on spend, and it is not set here — see Spending for the cap that actually stops runs, and History and usage for where the numbers live.
Two things worth knowing when you compare providers:
- An investigation is several calls, not one. Agent iterations dominate; the classifier and metadata extraction are small but run on every ticket.
- Cheaper models make more iterations. A model that needs twelve tool calls where a better one needs four is not necessarily cheaper, and it is definitely slower.
Audit
Every provider create, update and delete writes an audit entry. See Audit log.