Everything an agent reads goes to the model provider: messages, documents and tool results. Check each provider's data terms before you use real data. Hivelock does not control what a provider does with it.
Add a provider
Providers belong to a workspace. An admin sets them up under Settings, then AI models.
- Enter the server address. You can also fill it in from an example.
- Enter the API key, if it needs one.
- Press Find models. Hivelock asks the server which models it offers.
- Choose a model for each role.
- Save the provider, then press Test. It sends a small request to each model you chose.
Keys are encrypted when saved and never shown again. A saved key only goes to its own address, so if you change the address you must enter the key again.
Use any provider
You are not limited to a list. Enter the address of any server that speaks the OpenAI chat API, on the internet or on your own network.
- Server address is the only field you must fill in.
- Name and API key are optional.
- Main model is optional. If it is empty, Hivelock uses the first model the server lists. A server that lists no models needs a model name.
- Extra request settings add your own JSON to every model request.
Example addresses
These can fill in the form for you, and you can change anything afterwards.
| Service | Address |
|---|---|
| Kimi | https://api.moonshot.ai/v1 |
| OpenAI | https://api.openai.com/v1 |
| Anthropic | https://api.anthropic.com/v1 |
| DeepSeek | https://api.deepseek.com/v1 |
| Groq | https://api.groq.com/openai/v1 |
| OpenRouter | https://openrouter.ai/api/v1 |
| NVIDIA | https://integrate.api.nvidia.com/v1 |
| Ollama, on your own server | http://localhost:11434/v1 |
| LM Studio, on your own server | http://localhost:1234/v1 |
Agents rely on tool calling, so choose a model that supports it. A model that only chats will not be able to use connections.
Model roles
| Role | Used for |
|---|---|
| Main | Reasoning and tools. Required. A blank role below falls back to this model. |
| Fast | Simple, high-volume work. |
| Coding | Writing code. |
| Embedding | Optional. Turns document passages into numbers, so search can find meaning as well as keywords. Keyword search works without it. |
Fallback order
Providers are tried from top to bottom, and you can move them up and down. If the first fails, the next takes over.
- Each model gets up to 2 retries, and a 120-second time limit per attempt.
- Only providers that are turned on are used.
- With confidential mode on, only cleared providers are in the list.
- If none is left, the step fails and says why. It does not quietly use another provider.
Observability shows which model answered each call.
Confidential mode
Confidential mode keeps work on providers a person has cleared. It is on by default for each workspace.
- Tick Cleared for confidential work on a provider only after you have checked its data terms, or if it runs on your own hardware.
- It covers agents, chats, drafting an agent, and document embeddings.
- Importing a provider from server settings never clears it. Clearing is a person's decision.
- A run keeps the setting it started with.
While confidential mode is on and no provider is cleared, agents stop with an error that says so. Clear a provider, or turn the mode off.
Confidential mode is about AI model providers only. It does not limit connectors, so an agent can still send data to a service you connected. Use the recipient limits on each connection for that.
If you do not clear a provider that has an embedding model, files are still indexed, for keyword search only.
Local models
Local models keep the model step on your own network. They work on self-hosted servers, with no server settings to change.
- Start Ollama, LM Studio or another OpenAI-compatible server.
- Under Settings, AI models, press Add provider and enter its address.
- Press Find models if you want to choose a model, then save and press Test.
- Inside a container,
localhostmeans the container itself, so use a name the container can reach. - Only owners and admins can add model providers.
- Cloud metadata addresses are always refused, because they can hand out server credentials.
- The hosted service cannot reach private addresses, because customers share it.
Server default models
On a self-hosted server, a workspace with no providers uses the server's LLM_* and KIMI_* settings. Once a workspace has any provider, those are ignored completely.
Import from server settings moves them into encrypted settings. An owner can do this, on a workspace with no providers. Afterwards you can remove those lines from the settings file.
With server defaults, confidential mode works differently: it blocks NVIDIA models, and it needs a Kimi key. Providers in Settings are clearer, and we suggest using them.
Hosted mode has no server defaults. It will not start with a server key set, and each customer adds their own.
Costs and limits
- Enter input and output prices per million tokens on a provider, and Observability shows cost. Without prices, cost shows as unknown.
- Each workspace has a monthly token limit, 5,000,000 by default, under Settings, Usage and limits. One agent step can go past it before it stops.
- Your provider's own bill is what counts. Hivelock's figures are estimates from the prices you enter.
Checked against the code on 6 November 2026.