Provider keys are the upstream credentials your organization uses to call LLM providers like OpenAI, Anthropic, or Mistral. They live at the organization level. Workspaces inherit provider access by default and can pin or disable keys per provider.
Two ways to get provider access
Otari-managed keys
Use the Mozilla.ai inference catalog without bringing your own key material. Otari handles the upstream credential, and usage is billed against your wallet balance.
Your own keys
Bring your existing provider API keys and let Otari use them on your behalf. The upstream provider bills you directly, and Otari adds no per-token routing charge.
Most organizations use a mix. Managed keys are convenient for catalog models. Your own keys are for specific accounts, contracts, or providers not in the catalog.
How workspaces resolve provider keys
When a workspace makes a request, Otari resolves which provider key to use in this order:
If the workspace has a key pinned for the provider, use that.
Otherwise, use the organization default key for that provider.
If the workspace has explicitly disabled the org default, the request fails for that provider.
This means a workspace inherits everything by default but can opt out of specific keys or override defaults per provider.
Provider keys vs API Keys
These are two different things, and the naming is unfortunately close:
Provider keys are your upstream credentials, like your OpenAI or Anthropic key, that Otari uses to call providers. They are managed at the organization level.
API Keys are the workspace-scoped tokens your application sends to otari.ai. They are managed per workspace.
š”ļø Your application sends an API Key to Otari. Otari uses a provider key to call the upstream provider. The application never sees the provider key.
How security works
Organization scope. Provider keys are owned by the organization, not copied into each workspace.
Workspace controls. Each workspace decides which organization keys are effective for its workloads.
Role gating. Only admins and owners can add or remove provider key material, or change which keys a workspace can access.
Runtime resolution. Otari resolves the right provider key at request time. The workspace's API Key never carries the upstream secret.
Removing a provider key from Otari does not revoke it with the upstream provider. After deleting a key from Otari, also revoke it in the provider's dashboard.