In a workspace, go to Providers and add a key for any listed provider — OpenRouter, DeepSeek, OpenAI, Anthropic or Google. Use a key from the vendor directly (OpenAI, Anthropic, Google) when you need a direct contract with the model vendor rather than a reseller. The key is encrypted at rest and never shown to the model — every assistant/agent/custom-tool request that needs it has the key resolved just-in-time and attached as an auth header.
A connection is scoped to one workspace and one provider. There's no per-assistant "use my key vs. the platform's" toggle — once a workspace has a connection for a provider, everything in that workspace using that provider routes through it automatically, with no further setup.
Removing a connection doesn't touch any assistant or agent's configuration — nothing changes immediately. The next time one of them runs, it falls back to the platform key if one exists for that provider, or fails outright if it doesn't. Because that's easy to miss, removing a connection that's actually in use shows a confirmation naming exactly which assistants/agents are affected and whether a platform fallback exists, before you can proceed.
If you never connect a key, every assistant/agent in that workspace uses the platform's own key for models it has priced (the curated list) and can't use that provider for anything else. This is the default, zero-setup path — see Billing & credits for how it's charged.