LLM Providers
TapPass is a governed proxy in front of your LLM providers. Your agent talks to TapPass; TapPass governs the call, then talks to the provider with a key it holds, your agent never sees the provider key.
Support tiers
Section titled “Support tiers”Native (per-org BYOK). Store the provider key in the TapPass vault (dashboard → Settings → LLM providers, or tappass model key set <provider>). Falls back to a platform env key only if the operator enables it. Model is selected by prefixing the model name.
Server env. The operator sets provider credentials as server environment variables; all orgs route through them.
Self-hosted. Point TapPass at your own endpoint; no provider key involved.
Provider matrix
Section titled “Provider matrix”| Provider | Tier | Model prefix | Key / env |
|---|---|---|---|
| OpenAI | Native BYOK, server env | openai/ |
OPENAI_API_KEY |
| Anthropic | Native BYOK, server env | anthropic/ |
ANTHROPIC_API_KEY |
| Azure OpenAI | Native BYOK | azure/ |
AZURE_API_KEY + endpoint |
| Google Gemini | Native BYOK, server env | gemini/ |
GEMINI_API_KEY |
| AWS Bedrock | Native BYOK | bedrock/ |
AWS credentials |
| Mistral, DeepSeek, Groq, … | Native BYOK | mistral/, deepseek/, groq/ |
provider key (e.g. MISTRAL_API_KEY) |
| Ollama | Self-hosted | ollama/ |
none (base URL) |
| vLLM | Self-hosted | hosted_vllm/ |
HOSTED_VLLM_API_KEY (optional) |
| LM Studio | Self-hosted | lm_studio/ |
none (base URL) |
You can also register a custom self-hosted model with tappass model register --base-url … (the self-hosted provider).
How a call flows
Section titled “How a call flows”- Your client sends the request with its
tp_key. - The kernel governs it: facts, policy verdict, obligations, audit record.
- TapPass resolves the provider key (org BYOK vault first) and calls the provider.
- The response is governed on the way back and signed into the audit trail.