Customer-managed AI credentials

Flamekeeper organization administrators can bring their own OpenAI or Azure OpenAI credentials. When a customer-managed provider is active, every AI request for that organization uses that connection instead of Flamekeeper-managed credentials.

This option helps organizations follow internal AI vendor, procurement, billing, data-routing, and model-access policies. It does not by itself certify compliance with a law, framework, or company policy. Your security and legal teams should review the selected provider account, region, deployments, retention settings, and contract.

Before you begin

You need the Admin organization role in Flamekeeper and one of these provider setups:

• OpenAI: a project API key with access to the models and audio capabilities Flamekeeper uses. OpenAI explains how to create an API key in its developer quickstart.
• Azure OpenAI: an Azure OpenAI resource endpoint, API key, and deployment name for each configured capability. Flamekeeper uses Microsoft's current /openai/v1 API shape; see Azure OpenAI v1 API guidance.

Use a dedicated project or resource where possible. Apply your own spend limits, key-expiry policy, regional requirements, and provider-side access controls before connecting it.

Connect an OpenAI API key

1. Open Organization settings → AI provider.
2. Choose OpenAI.
3. Enter the API key.
4. Select Validate and activate.

Flamekeeper uses its configured OpenAI model set. The connection is not activated until every required capability passes validation.

Connect Azure OpenAI

1. Open Organization settings → AI provider.
2. Choose Azure OpenAI.
3. Enter the HTTPS resource endpoint, such as https://your-resource.openai.azure.com.
4. Enter the API key.
5. Enter the Azure deployment name for each capability:
   • primary text and handover review;
   • fast text;
   • transcription;
   • text-to-speech; and
   • realtime voice.
6. Select Validate and activate.

Use deployment names, not base model names, unless they are identical in your Azure resource. Each deployment must support its assigned operation. Azure realtime deployments must also be available in the resource's region.

What Flamekeeper validates

Before saving a new provider, Flamekeeper runs a small request against every configured capability:

• primary text generation and review;
• fast text generation;
• document input and extraction;
• audio transcription;
• text-to-speech; and
• realtime voice session creation.

All checks must succeed. If one fails, the new credential is not activated and the existing provider configuration remains unchanged. Validation requests may appear in the provider account's usage and billing records.

What changes after activation

The connection applies at organization level. Flamekeeper uses it for AI-assisted case creation, guided knowledge capture, document extraction and drafting, handover review, quality scoring, chat, transcription, speech, and voice sessions.

Flamekeeper does not split those features across customer-managed and Flamekeeper-managed providers. It also does not silently fall back to a Flamekeeper credential when the customer provider rejects a request or becomes unavailable. The affected AI action stops and shows an error instead.

Provider failure notifications

When a configured provider reports an authentication, permission, deployment, quota, or connectivity problem during an AI run, Flamekeeper:

• marks the connection Needs attention;
• shows a safe error to the person running the action;
• creates an in-app notification for every organization administrator; and
• emails every organization administrator.

Repeated alerts are limited to one notification cycle per 24 hours for the organization. Open Organization settings → AI provider to review the status, then select Revalidate all capabilities after correcting the provider configuration.

How the credential is handled

Flamekeeper encrypts the API key at rest. After it is saved, the browser receives only a masked hint containing the final four characters. The full key is not returned by the settings API and is not written to application logs.

Provider credentials are used by the Flamekeeper server, including when it establishes realtime voice sessions. OpenAI documents its server-created realtime client-secret endpoint in the Realtime API reference.

Your provider account owns the resulting API usage and charges. Review the provider's data controls, retention terms, regional processing, abuse-monitoring requirements, and model availability as part of your organization's approval process.

Rotate or replace credentials

Select Replace credentials, enter the complete new configuration, and run Validate and activate. Flamekeeper validates the replacement before overwriting the active connection. Revoke the old key at the provider only after the replacement succeeds.

If a deployment name changes in Azure, replace the configuration and enter all deployment fields again. Use Revalidate all capabilities when the credential is unchanged and you only need to confirm that the current setup still works.

Remove customer-managed AI

Selecting Remove deletes the stored customer credential. After removal, the organization returns to Flamekeeper-managed AI processing.

If your policy requires customer-managed credentials for all AI processing, replace or repair the connection instead of removing it. Confirm the active status before asking members to resume AI-assisted work.

Troubleshooting

Never send an API key in a support ticket. Share the provider name, validation capability, time of failure, and the safe error shown in Flamekeeper instead.