Prerequisites

Getting Started

What you need before connecting a provider. Requirements vary by provider — select yours below.

Workspace access

Before anything else, make sure you can log in to your AIControls workspace. Your administrator will have sent an invite email — use it to set your password and access https://YOUR_ORG.aicontrols.dev.

If you haven't received an invite, ask the person who manages AIControls for your organization to send one from Settings → Users → Invite.

Provider credentials

tip

Using Passthrough mode? No provider credentials are needed in AIControls — developers supply their own API keys directly. Passthrough mode is supported for Anthropic (Claude Code) and OpenAI (Codex). Skip to Step 3 — Generate a Personal Access Token.

If you're using Proxy mode, select your provider to see what credentials you'll need to enter in AIControls:

Anthropic

Anthropic

• An Anthropic API key — create one at console.anthropic.com → API Keys
• The default key scope is sufficient — no special permissions are required
• Note your API key's usage tier; higher tiers unlock higher rate limits

tip

Anthropic is the recommended starting point. AIControls supports all Claude models with full prompt caching, extended thinking, and tool-use governance.

What you'll enter in AIControls

Field	Where to find it
API Key	console.anthropic.com → Settings → API Keys

OpenAI

OpenAI

• An OpenAI API key — create one at platform.openai.com → API Keys
• A paid OpenAI account — free-tier keys cannot access GPT-4o and newer models
• Your Organization ID — only needed if your account belongs to multiple OpenAI organizations

What you'll enter in AIControls

Field	Where to find it
API Key	platform.openai.com → API Keys
Organization ID (optional)	platform.openai.com → Settings → Organization

Azure OpenAI

Azure OpenAI

• An Azure subscription with Azure OpenAI access — request it at aka.ms/oai/access if not already approved (approval can take 1–3 business days)
• An Azure OpenAI / Azure AI Foundry resource created in the Azure Portal
• At least one model deployed in that resource via Azure AI Foundry — note the deployment name you chose
• The resource's endpoint URL
• An Azure AD identity for AIControls to authenticate as — either a service principal (app registration with a client secret) or workload identity federation — with the Cognitive Services OpenAI User role on the resource. Your platform team sets this up on the AIControls proxy's environment.

note

Azure upstreams added via the AIControls Settings UI always authenticate via Azure AD managed identity (DefaultAzureCredential) — there's no API-key path here. Coordinate with your AIControls administrator to have the identity above configured before adding the upstream.

What you'll enter in AIControls

Field	Where to find it
URL	Azure Portal → your resource → Keys and Endpoint, plus /openai (e.g. https://YOUR_RESOURCE.cognitiveservices.azure.com/openai)
Model Patterns	Azure AI Foundry → Deployments → the deployment name(s) you chose (controls routing)
Static Model List	Azure AI Foundry → Deployments → the deployment name(s) you chose (controls what's advertised via model discovery)

note

This endpoint format is for Azure OpenAI-family models (e.g. GPT-4o). Routing Claude models through Azure AI Foundry instead (the Claude Code cloud provider gateway) uses a different endpoint format — check with your AIControls administrator for that setup.

Amazon Bedrock

Amazon Bedrock

• An AWS account with Amazon Bedrock enabled in your target region
• Model access explicitly granted — go to the Bedrock console → Model access and enable each model you want to use
• An IAM user or role with bedrock:InvokeModel permission scoped to your chosen model ARNs
• AWS Access Key ID and Secret Access Key for that IAM identity, or a Role ARN if AIControls should assume a role

warning

Model access in Bedrock is opt-in per region. If you see "Access denied" errors after setup, check that the specific model is enabled in the correct region in the Bedrock console.

Recommended IAM policy

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "bedrock:InvokeModel",
    "Resource": [
      "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-*",
      "arn:aws:bedrock:us-east-1::foundation-model/amazon.nova-*"
    ]
  }]
}

What you'll enter in AIControls

Field	Where to find it
Region	The AWS region where your Bedrock models are enabled, e.g. us-east-1
Access Key ID	IAM → Users → your user → Security credentials
Secret Access Key	Shown once when you create the access key — store it securely
Role ARN (optional)	IAM → Roles → your role → ARN (use instead of static keys if preferred)

Next steps

Once you have your credentials, continue to one of the setup paths:

• Onboarding Wizard — guided setup in the dashboard
• Manual Setup — step-by-step configuration