Developer guidesCloud provider onboarding
Browse this guide
Provider onboarding

Connect AWS and Chinese model families

Use the guided Admin workflow for AWS, Alibaba Cloud Model Studio, and Tencent Cloud TokenHub. For another open-weight model family, connect a verified OpenAI-compatible deployment as a manual upstream.

One safe workflow

  1. 1Sign in as a Super Admin and open Admin → Provider accounts.
  2. 2Choose a provider and region, enter its credentials, and select at least one model.
  3. 3Save the account and review every warning about inactive or unpriced models.
  4. 4Open Model availability and run a connection test for each new binding.
  5. 5Configure reviewed prices, team routes, and allowlists before production traffic.

Credentials stay server-side

API keys, AWS secret keys, and session tokens are encrypted by the backend. Onboarding responses contain only safe account metadata and never return plaintext or ciphertext credential fields. Admin database configuration is authoritative at runtime; changing deployment environment variables does not silently rewrite an existing account.

Provider credential

Gateway → upstream cloud

A Super Admin enters the AWS, Model Studio, TokenHub, or self-hosted provider credential. Ani Router encrypts it and uses it only to authenticate upstream requests.

Ani Router API key

Client → Ani Router

A user creates this key in the Ani Router dashboard and puts it in Claude Code, Codex, VS Code, or an SDK. It carries team permissions, limits, routing, and billing—not the cloud provider identity.

Provider selection is not the API format

Selecting AWS, Alibaba Cloud, Tencent Cloud, or Other defines the upstream account, region, endpoint, and credential. Chat Completions or Responses defines the request protocol used for a model. Start with OpenAI-compatible Chat Completions unless the model catalog explicitly marks Responses as native or compatibility-tested; tool use and streaming support are also model-specific.

Zero price is a placeholder, not free usage

A new China-cloud model without a verified price is created with zero-value placeholder pricing and remains inactive. Enter reviewed input and output prices and explicitly enable the model before sending production traffic, or billing and budget enforcement will be wrong.

Guided onboarding

AWS Bedrock

AWS onboarding selects Bedrock models already registered in the Ani Router catalog. Choose the same region where your account has model access; the guide offers common US, Europe, Singapore, and Tokyo regions.

Required

  • • Unique account name and AWS region
  • • At least one existing AWS catalog model
  • • Model access enabled for the AWS account
  • • A working Bedrock relay identity

Authentication

  • ENV — deployment environment identity.
  • ROLE — Role ARN; External ID is optional.
  • ACCESS_KEY — Access Key ID and Secret Access Key; Session Token is optional.

The relay is still required

Account credentials do not replace the B-machine relay identity. Configure a global RELAY_URL and relay secret, or a per-account relay, and make sure it can resolve the account name to an AWS identity that can invoke every selected model.

Onboard and verify

  1. 1Select AWS in Admin → Provider accounts, then choose the region and authentication mode.
  2. 2Enter the required identity fields and select only models this account can invoke.
  3. 3Save to create the account and selected model bindings.
  4. 4Run a connection test for every binding in Model availability.
  5. 5Review pricing and team access before enabling production routing.

Access key edits are paired for safety

When rotating an Access Key ID, submit its new Secret Access Key in the same update. A masked secret is accepted only when the Access Key ID is unchanged. If an account already has model bindings, create a replacement account—or remove its bindings—before changing the cloud provider.

AWS Bedrock model access

Model Studio

Alibaba Cloud

Model Studio uses an OpenAI-compatible regional endpoint. Ani Router gives each built-in model a stable alicloud/<upstream-model-id> name, while the account binding supplies the endpoint and encrypted API key.

What you need

  • A unique account name and the Model Studio region where model access is enabled.
  • A Model Studio API key for that account and product entry.
  • A Workspace ID for Singapore, Beijing, Hong Kong, Tokyo, or Frankfurt.
  • At least one built-in model that is actually enabled in your Model Studio console.

Workspace-scoped and shared endpoints

Singapore, Beijing, Hong Kong, Tokyo, and Frankfurt derive a Workspace-scoped endpoint from the region and Workspace ID. Virginia (us-east-1) uses https://dashscope-us.aliyuncs.com/compatible-mode/v1 and does not need a Workspace ID. Override the endpoint only for a confirmed special product entry or private gateway.

Catalog and production checks

  • Built-in families include Qwen, DeepSeek, Kimi, GLM, and selected MiniMax models.
  • The catalog is a versioned snapshot, not live discovery. Deselect anything your current console has not enabled.
  • New unpriced models stay inactive. Enter reviewed pricing, enable the model, test the binding, and then add team routing.
  • Existing model pricing and activation are preserved when onboarding is repeated.
Current built-in Alibaba snapshot · 11 model IDs

This is the catalog shipped with this deployment, not live provider discovery. Actual availability still depends on region, account permission, and the current Model Studio console.

alicloud/qwen3.7-maxalicloud/qwen3.7-plusalicloud/qwen3.6-flashalicloud/qwen3-coder-plusalicloud/qwen3-coder-flashalicloud/qwen3-coder-nextalicloud/deepseek-v4-proalicloud/deepseek-v4-flashalicloud/kimi-k2.7-codealicloud/glm-5.2alicloud/MiniMax-M2.5

Create a Model Studio API key · Model Studio model list

TokenHub preferred

Tencent Cloud

Use TokenHub for new integrations. Ani Router stores built-in models under stable tencent/<upstream-model-id> names and derives the default endpoint from the selected region.

Guangzhou · ap-guangzhou

https://tokenhub.tencentmaas.com/v1

Singapore · ap-singapore

https://tokenhub-intl.tencentmaas.com/v1

Never mix TokenHub and legacy credentials

TokenHub and legacy LKEAP are separate product entries. A TokenHub key must be paired with a TokenHub endpoint. If an existing account still uses legacy LKEAP, explicitly configure https://api.lkeap.cloud.tencent.com/v3 with a key issued for that product. TokenHub model IDs are not guaranteed to work on the legacy endpoint.

Onboard and verify

  1. 1Select Tencent Cloud in Provider accounts and choose Guangzhou or Singapore.
  2. 2Enter an API key issued for the endpoint you are using; keep the TokenHub default for new accounts.
  3. 3Select only the Hunyuan, DeepSeek, GLM, Kimi, MiniMax, or Qwen models enabled in your console.
  4. 4Save, review every zero-price warning, and keep unreviewed models inactive.
  5. 5Test each binding before configuring team routes and allowlists.
Current built-in Tencent snapshot · 19 model IDs

This is a versioned TokenHub-oriented catalog, not live provider discovery. Confirm every selected model in the current Tencent Cloud console; legacy LKEAP availability can differ.

tencent/hy3tencent/hy3-previewtencent/deepseek-v4-flash-202605tencent/deepseek-v4-pro-202606tencent/deepseek-v4-flashtencent/deepseek-v4-protencent/glm-5.2tencent/glm-5.1tencent/glm-5tencent/kimi-k3tencent/kimi-k2.7-code-highspeedtencent/kimi-k2.7-codetencent/kimi-k2.6tencent/kimi-k2.5tencent/minimax-m3tencent/minimax-m2.7tencent/minimax-m2.5tencent/qwen3.5-plustencent/qwen3.5-flash

TokenHub models and protocols · TokenHub migration guide

OpenAI-compatible

Other Chinese model families

InternLM, Yi, Baichuan, Xiaomi MiMo, and any family missing from the Alibaba or Tencent built-in catalog must not be assumed to be hosted by those clouds. Deploy an open-weight model yourself—or use a vendor that gives you a dedicated OpenAI-compatible endpoint—then register it as a manual upstream.

Manual onboarding path

  1. 1Deploy the model with vLLM, SGLang, Ollama, or another OpenAI-compatible server and verify its exact upstream model ID.
  2. 2In Admin → Models, create an OPENAI_COMPATIBLE model with a unique display name and exact upstream model ID. Leave model-level credentials empty when the account pool will own them.
  3. 3In Admin → Provider accounts, create an OTHER account with the HTTPS base endpoint and provider API key.
  4. 4In Model availability, bind the account to the model and set an upstream model override when it differs from the display name.
  5. 5Use the default Chat Completions format first. A different API format needs reviewed model metadata and a successful compatibility test.
  6. 6Enter reviewed prices, test non-streaming and streaming requests, configure team access, and only then enable production traffic.

Keep custom catalog policy explicit

The production canonical-catalog reconciliation job may disable unexpected non-namespaced models. Manage manual OTHER models with a separate catalog policy, or do not run reconciliation in APPLY mode against that environment. Do not rename a manual model into the alicloud/ or tencent/ namespace unless the corresponding cloud provider serves it.

vLLM OpenAI-compatible server

Production launch checklist

A saved provider account is only the first step. Complete all checks below before allowing team traffic.

  • The provider, region, endpoint, and credential belong to the same cloud product entry.
  • Every selected model is enabled for the account in the current provider console.
  • Input and output prices are reviewed; no zero placeholder is treated as free usage.
  • The model and account-model binding are active and pass a connection test.
  • Streaming and non-streaming calls work with the exact namespaced or custom model ID.
  • Team routes, allowlists, budgets, and rate limits are configured.
  • Provider credentials are stored only in Admin or deployment secrets and never committed to Git.

Ready to test

Use an Ani Router API key from the target team for the final request. This verifies the complete path: team permission, routing, provider binding, upstream authentication, usage logging, and billing.

Next step

Open Provider accounts

Choose a provider, connect at least one model, then verify pricing and binding health before production traffic.