AI providers

Workspace admins configure AI under Settings → General. Tusko supports OpenAI, Azure OpenAI, Anthropic, xAI, Z.ai, and OpenRouter through the application’s provider adapter.

API keys are encrypted at rest using key material derived from SESSION_SECRET and are masked in API responses. Back up that secret securely: changing it without a migration makes stored credentials unreadable.

If no workspace credential exists, the server can use LLM_PROVIDER, LLM_API_KEY, LLM_MODEL, LLM_ENDPOINT, and LLM_API_VERSION as an operator-managed fallback. Embeddings currently use the environment-level LLM key.