Integrations — Model providers
NerveStax and OpenAI
Your OpenAI key, your agreement. We never proxy the calls.
What we do
What NerveStax does with OpenAI
Add your organization's OpenAI API key and NerveStax runs its agents on it. There is no shared key behind the product: with no provider configured, agents refuse to run. The same path serves any OpenAI-compatible endpoint, including a gateway or proxy you run yourself, by setting a base URL alongside the key.
-
Your key, per organization
Each organization adds its own key. NerveStax has no fallback key, so with none configured the agent stops with a clear error instead of running on someone else's account.
-
Choose the model per agent
Assign models per agent rather than one model for the whole product: a cheaper one for context and triage, a stronger one where a change is being designed and reviewed.
-
Point it at a gateway
Any OpenAI-compatible endpoint works by setting a base URL with the key, so an internal proxy, a gateway that enforces policy, or a model you host yourself all fit the same path.
-
Calls are never proxied by us
Requests go from your NerveStax deployment to the endpoint you configured. The product ships no third-party analytics or error-tracking SDKs to carry anything elsewhere.
-
Spend tracked per call
Each model call is recorded with organization, workspace, user, conversation, agent, model and token counts, so cost is attributable to a team and an agent, not just a monthly total.
Background
About OpenAI
OpenAI sells API access to the GPT family of models. Teams hold their own key and their own agreement, and usually already have one in place for other internal tools.
How it connects
What connecting it looks like
-
01
Create an OpenAI API key
Make a key in your OpenAI account, ideally scoped to this use so it can be rotated independently of other tools.
-
02
Add it under AI providers
Paste it into Settings. It is encrypted at rest under a key held outside the database, and no screen shows it again.
-
03
Set a base URL if needed
Using a gateway or proxy instead of api.openai.com? Add its base URL with the key and everything else stays the same.
-
04
Assign models to agents
Pick a model per agent, then check the token usage page after a week and adjust from what the numbers show.
Scope
What this does not cover
- What reaches the provider: schemas and table metadata, dbt artifacts, repository files, command output and Airflow logs with secrets redacted, alert payloads, and, when an agent queries or samples a table, the rows it retrieves.
- Secrets are redacted from what the model reads. Result rows are not masked, so treat the provider as in scope for whatever an agent is allowed to query.
- A token usage record is written per call; with some gateways in front of OpenAI, token counts depend on the gateway reporting usage.
Questions
OpenAI and NerveStax
Q01Does NerveStax see or store our OpenAI key?+
It is stored encrypted with AES-256-GCM under a key held outside the database, referenced by a handle, and no endpoint reveals it; screens show a masked value. Self-hosted, that database and that encryption key are yours. Calls go from your deployment to OpenAI, never through us.
Q02What exactly is sent to OpenAI?+
Schemas and table metadata, dbt manifest, lineage and run results, repository file contents, command output and Airflow logs with secrets redacted, uploaded documents, alert payloads, and the rows an agent retrieves when it queries or samples a table. It goes under your key and your agreement with OpenAI.
Q03Can we route through our own gateway?+
Yes. Any OpenAI-compatible endpoint is supported by setting a base URL with the key, which covers an internal proxy, a policy gateway, or a model you host. That is also the path teams use when data must not leave their own network.
Q04What happens if no key is configured?+
Agents do not run. There is no platform fallback key, so a missing provider raises a configuration error rather than quietly sending your schemas somewhere on an account you did not choose.
Q05Can different teams use different models?+
Providers and models are set per organization, and models are assigned per agent within it. Usage is recorded per workspace, user and agent, so a team can see and defend its own share of the bill.