Primary use
Execution accessNo real run should start without provider posture being intentional.
Workflow
Provider Vault
Provider Vault is where execution access becomes real. Use it to connect providers through Provider Vault, choose default models, control provider-usage posture, and decide when Mock Mode is the better fit.
Guide summary
Use this page to understand the surface before you act inside it.
Configure BYOK providers, Mock Mode posture, default models, and safe runtime access.
Guide type
WorkflowThis guide reflects the current product workflow and surface ownership.
Sections
8Summary first, then steps, mistakes, and recovery notes.
Related guides
6Written against the current product structure and core execution workflow.
Security rule
Keys are encryptedCredentials stay server-side and are not shown again after save.
Related action
Contact SupportUse support if the provider looks valid but the runtime still cannot use it.
Guide section
What it is
Provider Vault manages provider credentials, default models, budget posture, and the boundary between Mock Mode and live provider execution.
When to use it
Use it before live execution, when rotating a key, when changing model posture, or when investigating provider failures.
Where to find it
Find it in the authenticated product as Provider Vault.
What happens next
You use this surface as part of the broader mission -> task -> run -> artifact workflow.
Common mistake
Using the wrong provider account
Related action
Open the dedicated “Provider key invalid” troubleshooting guide if the failure is credential-specific.
Guide section
Why it matters
It protects keys, keeps provider billing responsibility explicit, and prevents operators from running against an undefined model lane.
Guide section
How it fits into the workflow
Provider Vault feeds the execution lane used by operators, tasks, and runs.
Guide section
Step-by-step usage
- Choose the provider you want to use.
- Add or rotate the API key in a secure session.
- Choose the default model and any supported defaults.
- Review budget or usage posture if it is configured.
- Return to Launch Mission or Runs once the provider shows a healthy state.
Guide section
Inputs and outputs
Inputs needed
Provider type
A valid API key
A supported model choice
Budget posture if used
Outputs produced
Stored encrypted provider access
A usable default model
Clear execution readiness for future runs
Guide section
Common mistakes
- Using the wrong provider account
- Picking an unsupported model
- Assuming the key can be copied later from the UI
- Ignoring provider-specific errors
Guide section
Troubleshooting
If a provider shows invalid key or unsupported model errors, update the credential, verify model access, or temporarily switch to Mock Mode while you recover.
Guide section
Supported providers and cost posture
Supported providers appear in the product UI. BYOK means the provider bills model usage separately from your opheli.ai plan.
opheli.ai controls the execution environment; it does not hide or absorb provider usage charges.
Provider usage values shown in opheli.ai are estimates unless explicitly marked Verified by Provider. Verify final charges in the Provider dashboard.
Who pays provider/API costs?
Your provider account does.
When should I rotate a key?
Rotate when a credential is revoked, exposed outside its secure boundary, or no longer belongs to the right operating account.