Bring your own endpoint

Paste the credential once and your callers keep using CONIFER_API_KEY. The provider bills you directly on your own contract and Conifer adds no fee. The receipt header x-conifer-endpoint reads byok:<provider> when your own key served a request and credits otherwise. Running weights on your own hardware is a different thing, covered under Run a model.

A pasted key is verified against the provider before it is stored, then kept encrypted. The console and GET /v1/keys show only the provider, its status, the last four characters and, for Azure, the resource URL. DELETE /v1/keys/{provider} removes it.

Azure OpenAI#

An Azure OpenAI credential is two values, the resource URL and the key for that resource. You do not register deployments. You name the deployment in the request’s model field.

Save the endpoint#

Open the console keys view, pick Azure OpenAI, and paste the resource URL https://{resource}.openai.azure.com/openai/v1 and the Azure API key. The gateway checks the key against your resource before storing it. If Azure rejects the key, the response is a 422 and nothing is stored. For scripts, the same call is PUT /v1/keys/azure with {"api_key":"...","base_url":"https://{resource}.openai.azure.com/openai/v1"}, or from the CLI:

printf %s "$AZURE_KEY" | conifer keys add azure --url https://{resource}.openai.azure.com/openai/v1

The credential lives on the gateway, so your callers keep using CONIFER_API_KEY. If you would rather have conifer run call the resource directly from your machine, register it as a local CLI endpoint instead:

printf %s "$AZURE_KEY" | conifer endpoints add byok azure --url https://{resource}.openai.azure.com/openai/v1

Call a deployment#

curl https://api.conifer.build/v1/chat/completions \
  -H "Authorization: Bearer $CONIFER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "YOUR_DEPLOYMENT_NAME",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "three names for a build cache"}]
  }'

Set model to the deployment name, or to azure/<deployment>. Your deployments do not appear in GET /v1/models. Give deployments names that differ from catalog models. A deployment named gpt-5.4 would be served from the catalog rather than your resource. Entra ID and managed identity are not available on this self-serve form.

Any OpenAI-compatible endpoint#

Anything that speaks the OpenAI wire can be registered in the CLI as a remote endpoint: vLLM, Ollama, LM Studio, llama.cpp’s server, or an internal deployment. The token is read from stdin and kept in the OS secret store.

printf %s "$TOKEN" | conifer endpoints add remote studio-m2 \
  --url https://models.internal.example.com/v1 \
  --token

The CLI probes the server’s GET /v1/models during the add, and the models it lists become targets for conifer run. Endpoint ids take the form kind:slug, so this one is remote:studio-m2. Plain http is allowed for loopback and private LAN addresses only.

conifer endpoints add remote workshop \
  --url http://192.168.1.40:11434/v1

conifer endpoints list
conifer endpoints show remote:studio-m2
conifer endpoints remove remote:studio-m2

Bedrock & Vertex#

AWS Bedrock and Google Vertex are not served through api.conifer.build today. If that blocks you, tell us on the SDK issue tracker.