LLM credentials

Mate is bring-your-own-key (BYOK): it never charges for LLM usage directly. You supply an API key from your own account, and requests are billed there at the provider’s rates.

This is Step 4 of the onboarding wizard (after setting the GitLab URL, registering the bot, and saving an agent config).

Choose a provider

Two providers are supported:

Provider	Where to get a key
OpenRouter	openrouter.ai/keys — routes to many models through one key
Anthropic direct	console.anthropic.com/settings/keys — direct access to Claude models

Select the provider that matches your key. The label on the selector tells you which environment variable the key will be injected as (OPENROUTER_API_KEY or ANTHROPIC_AUTH_TOKEN).

Note

Mate-managed credit (pre-paid credit, no separate LLM account needed) is shown but disabled and marked “available after GA”. It is not yet usable.

Paste the key

1. Select the provider.
2. Paste the API key into the API key field. Keys must be between 20 and 500 characters.
3. Click Save and continue.

When you save, Mate verifies the key with the provider before storing it — a live call to GET https://openrouter.ai/api/v1/key for OpenRouter or GET https://api.anthropic.com/v1/models for Anthropic:

• Valid (the provider accepts the key): it’s saved and you continue.
• Rejected (the provider returns 401/403): the key is not stored and you get an inline error — fix it before your first job fails.
• Provider unreachable (network error or a provider-side 5xx): the key is saved unverified so a transient outage doesn’t block onboarding. If it later turns out to be wrong, your first job will fail — re-check the key.

Mate encrypts the key at rest using AES-256-GCM. The key is not retrievable after submission.

Rotating the key

To replace the key, re-run the onboarding wizard from the workspace overview and submit a new key in the LLM credentials step — submitting a new key overwrites the previous one. A dedicated settings panel for LLM credentials does not exist yet; the onboarding flow is currently the only path.

Next: Register a webhook