Prerequisites

Getting Started

What you need before connecting a provider. Requirements vary by provider — select yours below.

Workspace access

Before anything else, make sure you can log in to your AIControls workspace. Your administrator will have sent an invite email — use it to set your password and access https://YOUR_ORG.aicontrols.dev.

If you haven't received an invite, ask the person who manages AIControls for your organization to send one from Settings → Users → Invite.

Provider credentials

tip

Using Passthrough mode? No provider credentials are needed in AIControls — developers supply their own API keys directly. Passthrough mode is supported for Anthropic (Claude Code) and OpenAI (Codex). Skip to Step 3 — Generate a Personal Access Token.

If you're using Proxy mode, select your provider to see what credentials you'll need to enter in AIControls:

Anthropic

Anthropic

• An Anthropic API key — create one at console.anthropic.com → API Keys
• The default key scope is sufficient — no special permissions are required
• Note your API key's usage tier; higher tiers unlock higher rate limits

tip

Anthropic is the recommended starting point. AIControls supports all Claude models with full prompt caching, extended thinking, and tool-use governance.

What you'll enter in AIControls

Field	Where to find it
API Key	console.anthropic.com → Settings → API Keys

OpenAI

OpenAI

• An OpenAI API key — create one at platform.openai.com → API Keys
• A paid OpenAI account — free-tier keys cannot access GPT-4o and newer models
• Your Organization ID — only needed if your account belongs to multiple OpenAI organizations

What you'll enter in AIControls

Field	Where to find it
API Key	platform.openai.com → API Keys
Organization ID (optional)	platform.openai.com → Settings → Organization

Azure OpenAI

Azure OpenAI

• An Azure subscription with Azure OpenAI access — request it at aka.ms/oai/access if not already approved (approval can take 1–3 business days)
• An Azure OpenAI / Azure AI Foundry resource created in the Azure Portal
• At least one model deployed in that resource via Azure AI Foundry — note the deployment name you chose
• The resource's endpoint URL
• An Azure AD identity for AIControls to authenticate as — either a service principal (app registration with a client secret) or workload identity federation — with the Cognitive Services OpenAI User role on the resource. Your platform team sets this up on the AIControls proxy's environment.

note

Azure upstreams added via the AIControls Settings UI always authenticate via Azure AD managed identity (DefaultAzureCredential) — there's no API-key path here. Coordinate with your AIControls administrator to have the identity above configured before adding the upstream.

What you'll enter in AIControls

Field	Where to find it
URL	Azure Portal → your resource → Keys and Endpoint, plus /openai (e.g. https://YOUR_RESOURCE.cognitiveservices.azure.com/openai)
Model Patterns	Azure AI Foundry → Deployments → the deployment name(s) you chose (controls routing)
Static Model List	Azure AI Foundry → Deployments → the deployment name(s) you chose (controls what's advertised via model discovery)

note

This endpoint format is for Azure OpenAI-family models (e.g. GPT-4o). Routing Claude models through Azure AI Foundry instead (the Claude Code cloud provider gateway) uses a different endpoint format — check with your AIControls administrator for that setup.

Amazon Bedrock

Amazon Bedrock

• An AWS account with Amazon Bedrock enabled in your target region
• Model access explicitly granted — go to the Bedrock console → Model access and enable each model you want to use
• An IAM role with bedrock:InvokeModel permission scoped to your chosen model and inference-profile ARNs, which AIControls assumes to sign requests

warning

Model access in Bedrock is opt-in per region. If you see "Access denied" errors after setup, check that the specific model is enabled in the correct region in the Bedrock console.

Inference profiles

Claude 3.7 and newer cannot be invoked through a bare regional model ID — Bedrock requires a cross-Region inference profile, whose ID carries a geography prefix (us., eu., apac., us-gov.) or global.:

us.anthropic.claude-sonnet-4-5-20251001-v1:0
global.anthropic.claude-sonnet-4-5-20251001-v1:0

AIControls translates short model names to the matching profile ID for you, so your clients keep sending claude-sonnet-4-5. Pick which profile with the Inference Profile field on the upstream; it defaults to US.

Requests always go to the endpoint for the region you configured, signed for that region — Bedrock performs the cross-Region routing itself. Choosing a different profile does not change where AIControls connects.

warning

Global routes to any commercial AWS Region, giving the highest throughput with no cross-Region surcharge — but your prompts may be processed outside your geography. Don't use it where data residency is constrained. It is also supported only by newer models (Claude Opus 4.7/4.8, Sonnet 4.6, and later); older ones must use a geography profile. Check the Bedrock model support matrix before enabling it.

Recommended IAM policy

A geography profile (us., eu., apac.) needs the profile ARN plus the underlying foundation models in the regions it routes to:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
    "Resource": [
      "arn:aws:bedrock:*::foundation-model/anthropic.claude-*",
      "arn:aws:bedrock:*::foundation-model/amazon.nova-*",
      "arn:aws:bedrock:*:123456789012:inference-profile/*.anthropic.claude-*"
    ]
  }]
}

Global profiles need a third ARN. Alongside the regional profile and the regional foundation model, you must also grant the foundation model with both the region and account left empty — that is what authorizes execution in the other regions Bedrock routes to. Omitting it is the usual cause of an access-denied error that looks like a model-access problem:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": "arn:aws:bedrock:us-east-1:123456789012:inference-profile/global.anthropic.claude-sonnet-4-5-20251001-v1:0"
    },
    {
      "Effect": "Allow",
      "Action": ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      "Resource": [
        "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-sonnet-4-5-20251001-v1:0",
        "arn:aws:bedrock:::foundation-model/anthropic.claude-sonnet-4-5-20251001-v1:0"
      ],
      "Condition": {
        "StringLike": {
          "bedrock:InferenceProfileArn": "arn:aws:bedrock:us-east-1:123456789012:inference-profile/global.anthropic.claude-sonnet-4-5-20251001-v1:0"
        }
      }
    }
  ]
}

Replace 123456789012 with your AWS account ID and us-east-1 with your configured region. Narrow the wildcards once you know which models you actually use.

What you'll enter in AIControls

Field	Where to find it
AWS Region	The AWS region where your Bedrock models are enabled, e.g. us-east-1
IAM Role ARN	IAM → Roles → your role → ARN
Inference Profile	Which profile to invoke: US (default), Europe, Asia Pacific, GovCloud, or Global

Bedrock upstreams use IAM authentication — there are no access-key fields, and the endpoint URL is derived from the region.

Next steps

Once you have your credentials, continue to one of the setup paths:

• Onboarding Wizard — guided setup in the dashboard
• Manual Setup — step-by-step configuration