> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Model providers

> Choose where Paladin and Opal's other AI features run inference: on Opal's Anthropic account, your own Anthropic account, or your own Amazon Bedrock account.

## Overview

Paladin and Opal's other AI features run on Anthropic's Claude models. You choose whose account the requests run through. The setting applies to your whole organization, under **Configuration** > **Settings** > **AI Features** > **LLM Provider**.

| Provider | Who pays for inference | Where inference runs | Available on |
| - | - | - | - |
| **Anthropic - Opal managed** | Opal | Anthropic, on Opal's account | Opal cloud |
| **Anthropic - Your account** | You | Anthropic, on your account | Opal cloud and self-hosted |
| **Amazon Bedrock - Your account** | You | Your AWS account | Opal cloud and self-hosted |

Opal managed is the default on Opal cloud and needs no setup. If you choose your own account and that provider is unavailable, Opal does not fall back to its own account. Use your own account when you want:

* Inference usage billed to your own Anthropic or AWS account.
* Data retention governed by your own agreement with the provider.
* Your own spend and rate limits.
* Inference kept inside your AWS boundary (Bedrock only).

If you self-host Opal, you must connect your own account. See [Set up Paladin on self-hosted Opal](https://docs.opal.dev/docs/paladin/self-hosted-setup.md).

## Connect a provider

> [tab] Anthropic API
>
> Inference runs on Anthropic's hosted API, on your own Anthropic account.
>
> > [!WARNING]
> >
> > Don't add your key under **Inventory** > **+App** > **Anthropic**. That's the [Anthropic Platform](https://docs.opal.dev/integrations/anthropic.md) integration, which manages access to your Anthropic workspaces. Its **Admin Key** and **Enterprise API Key** fields don't connect Paladin to your account. To run Paladin on your account, connect the key under **Configuration** > **Productivity Integrations** instead, as described below.
>
> **1. Create an API key**
>
> On the [Claude platform](https://platform.claude.com/settings/keys), create an API key. Use a service account key scoped to a single workspace, not an Admin API key or a personal key. A personal key stops working when the person who created it leaves your organization. A dedicated workspace for Opal lets you set its own spend and rate limits.
>
> **2. Connect Anthropic API in Opal**
>
> Go to **Configuration** > **Productivity Integrations**. In the **AI** section, select **Connect** next to **Anthropic API**, paste the key, and select **Create**. Opal checks the key with Anthropic when you save it, and stores it encrypted.
>
> ![The Link Anthropic API dialog, with a field for the Anthropic API key and a Create button.](https://mintcdn.com/opalsecurity/PfcD7_PQsnIjFDg6/images/docs/paladin-anthropic-api-key.png?fit=max\&auto=format\&n=PfcD7_PQsnIjFDg6\&q=85\&s=35808913f9d780056e32234f4c602b1f)
>
> Paste your Anthropic API key when you connect the Anthropic API integration.
>
> **3. Select it as your provider**
>
> Go to **Configuration** > **Settings** > **AI Features**, and under **LLM Provider**, select **Anthropic - Your account**. The option stays disabled until the Anthropic API integration is connected.
>
> ![The LLM Provider dropdown in AI Features settings, listing Anthropic - Opal managed, Anthropic - Your account, and Amazon Bedrock - Your account.](https://mintcdn.com/opalsecurity/PfcD7_PQsnIjFDg6/images/docs/paladin-ai-provider-options.png?fit=max\&auto=format\&n=PfcD7_PQsnIjFDg6\&q=85\&s=12bcbce780ef79532dfbcfe1f0dedf69)
>
> Choose Anthropic - Your account as the LLM provider.

> [tab] Amazon Bedrock
>
> Inference stays inside your own AWS account.
>
> **1. Enable Claude in Bedrock**
>
> In your AWS account, make sure Amazon Bedrock and the Claude models are enabled.
>
> **2. Connect Amazon Bedrock in Opal**
>
> Go to **Configuration** > **Productivity Integrations**. In the **AI** section, select **Connect** next to **Amazon Bedrock**, and paste a long-lived Bedrock API key generated in your AWS account. Opal stores the key encrypted.
>
> ![The Link Bedrock dialog, with a field for the Bedrock token and a Create button.](https://mintcdn.com/opalsecurity/PfcD7_PQsnIjFDg6/images/docs/paladin-bedrock-token.png?fit=max\&auto=format\&n=PfcD7_PQsnIjFDg6\&q=85\&s=bffb96358dbc33a98cbc63015b61af59)
>
> Paste a Bedrock API key when you connect the Amazon Bedrock integration.
>
> **3. Select it as your provider**
>
> Go to **Configuration** > **Settings** > **AI Features**, and under **LLM Provider**, select **Amazon Bedrock - Your account** and choose the AWS region. Bedrock uses cross-region inference. The default region is `us-west-2`.
>
> ![The LLM Provider setting set to Amazon Bedrock - Your account, with the Bedrock region field below it.](https://mintcdn.com/opalsecurity/PfcD7_PQsnIjFDg6/images/docs/paladin-bedrock-provider.png?fit=max\&auto=format\&n=PfcD7_PQsnIjFDg6\&q=85\&s=705d84d75919e2873484b5d969903aed)
>
> Choose Amazon Bedrock - Your account, then set the Bedrock region.

## Data handling

Prompts go only to the provider you selected. With your own account, usage, billing, and data retention fall under your agreement with that provider. For a full data-flow and subprocessor breakdown for a security or compliance review, contact your Opal representative.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.