airlock can give every member one AI endpoint for model calls. Their AI tools (Claude Code, Cursor, your own code) send their requests there instead of to a provider. airlock forwards each one to the provider on your company key, and only to the models an admin allowed. Members never hold a provider key, and the call is recorded with the person and the tool that made it.
This page covers the whole setup: an admin stores the provider keys, picks the models and sets routing, and each member points their tools at the endpoint.
AI models are opened per organization. The AI models group on the Rules page and the AI endpoint card on Settings, Account appear only after airlock has turned the feature on for your organization. If you do not see them, ask your airlock contact.
1. Store a provider key (admin)
Open Rules → AI models → Model providers.
- Click Add a provider, or the line under it that says how many providers are on the list. The list groups providers by where they are hosted: in the EU, elsewhere, or your own.
- Pick a provider and paste its key. Some providers need one more value: Amazon Bedrock needs the AWS region its key belongs to.
- Click Store the key.
airlock checks the key with the provider before storing it. A key the provider refuses is not stored, and neither is a key airlock could not check because the provider did not answer. Replacing a key works the same way: when the new key fails the check, the old one stays in use.
After storing a key, airlock reads the list of models the key can use. It reads that list again only when you replace the key or click Read again in the provider's row. Use Read again after the provider adds a model you want.
The key is encrypted and never shown again. To stop using a provider, open its row and click Remove.
Azure OpenAI, Melious and self-hosted servers can be stored, but airlock cannot route calls to them yet. Their rows say so.
2. Pick the models people may call (admin)
Open a provider's row. It lists the models read from the key, with the date of the read. Tick the models your members may call. Calls to a model that is not ticked are refused.
- Bedrock lists every model it offers in the key's region. The key's own AWS permissions can still refuse some of them.
- OpenRouter models marked Free may have their prompts logged and used for training by the provider.
- Models that cannot chat (embedding, image or speech models) can be ticked and called by name, but cannot be the default model and are never picked by Auto.
Then set Model providers to Enable. While it is on Disable, airlock serves no model calls: a tool pointed at the AI endpoint is refused, and tools that call a provider directly, on keys people hold themselves, are unaffected.
3. Set the default model and Auto routing (admin)
Open Rules → AI models → Auto routing.
Default model takes every call that names no model, and every call Auto cannot place. Pick one of the ticked chat models. Until you do, the endpoint refuses every call, and it does the same when the default model's key is removed.
Auto routing decides what happens to a call that asks for airlock/auto:
With keywords on, five kinds of work each get a model: Quick, Writing, Coding & data, Reasoning and Research. Each kind starts on the default model, shown as <model> (default). Pick another model for any kind you want handled differently; picking the default again puts it back. When you change the default model, every kind still on the default moves with it.
The keyword router understands English, Dutch, French, German, Spanish and Italian. It uses no AI model and none of your tokens. When no keyword matches, it compares the prompt with each kind's Example prompts (one per line, editable under each kind). A short prompt that still fits nothing counts as Quick; anything else goes to the default model.
A person can always name a model instead of airlock/auto, and the call then goes straight to that model.
Usage limits is in the same group, but spending limits are not enforced yet: airlock does not track model prices so far.
4. Allow personal API tokens (admin)
Members use their personal API tokens as the key for the endpoint. Check that Settings → Security → Allow personal API tokens is on (it is off by default). When it is off, members cannot create a key, and the AI endpoint card says so. See Authentication.
If your organization has a network allowlist, it applies to the AI endpoint too: tools have to call it from an allowed network.
5. Connect an AI tool (every member)
Open Settings → Account → AI endpoint. Your LLM gateway endpoint sits above it, beside your MCP endpoint: one address for every tool. The card shows the models you can call and setup steps for each tool.
- Under Your keys, describe what the key is for (for example "Claude Code on my laptop") and click Create a key. Copy it: it is shown only once. Create one key per tool or machine, so you can turn one off without touching the others.
- Pick your tool's tab and follow its steps. The card fills in your address and the model to use. It fills in the key only while the new key is on screen; after you click Done, or when you come back later, paste the key you saved.
Claude Code speaks the Anthropic API. Put these lines in your shell profile, with the values from the card:
export ANTHROPIC_BASE_URL=<your LLM gateway endpoint>
export ANTHROPIC_AUTH_TOKEN=<your key>
export ANTHROPIC_MODEL=<model from the card>
export ANTHROPIC_DEFAULT_HAIKU_MODEL=<model from the card>If ANTHROPIC_API_KEY is set in your shell, unset it, or Claude Code sends that key instead. /model still switches to any model listed on the card.
Cursor speaks the OpenAI API. In Cursor Settings, Models, turn on Override OpenAI Base URL, paste your LLM gateway endpoint, paste your key as the OpenAI API key and add a model from the card. While the override is on, Cursor sends every chat model to airlock.
Anything else that lets you set an OpenAI base URL and a key works the same way:
curl <your LLM gateway endpoint>/chat/completions \
-H "Authorization: Bearer $AIRLOCK_KEY" \
-H "Content-Type: application/json" \
-d '{"model": "<model from the card>", "messages": [{"role": "user", "content": "Hello"}]}'GET /models on the address lists the models you can call. In your own code, pass the key as the auth token (the Authorization header), not as a provider API key.
The model from the card is airlock/auto when your organization's default model speaks that tool's API, and otherwise a model that does: airlock/auto works only on an API the default model speaks.