LLM Providers
TapPass is a governed proxy in front of your LLM providers. Your agent talks to TapPass; TapPass governs the call, then talks to the provider with a key it holds — your agent never sees the provider key.
Support tiers
Section titled “Support tiers”Native (per-org BYOK). Store the provider key in the TapPass vault (dashboard → Settings → LLM providers, or tappass model key set <provider>). Falls back to a platform env key only if the operator enables it. Model is selected by prefixing the model name.
Server env. The operator sets provider credentials as server environment variables; all orgs route through them.
Self-hosted. Point TapPass at your own endpoint; no provider key involved.
Provider matrix
Section titled “Provider matrix”| Provider | Tier | Model prefix | Key / env |
|---|
You can also register a custom self-hosted model with tappass model register --base-url … (the self-hosted provider).
How a call flows
Section titled “How a call flows”- Your client sends the request with its
tp_key. - The kernel governs it: facts, policy verdict, obligations, audit record.
- TapPass resolves the provider key (org BYOK vault first) and calls the provider.
- The response is governed on the way back and signed into the audit trail.