LLM Settings Configuration
Zeeq exposes organization-level LLM settings under Settings > LLM Configuration. Owners and admins can choose a provider, model, and key source for the shared Fast, High, and Max workload tiers.
The settings are intentionally shared infrastructure. Code reviews are an early consumer, but document processing, memories, agents, and future LLM-backed workflows can use the same organization configuration.
Access
Only organization owners and admins can read or change LLM settings and key metadata.
Non-admin members can open the route, but the page shows an access-required notice instead of loading provider settings or encrypted key metadata.
Model Tiers
The UI configures three named tiers:
| Tier | Intended use |
|---|---|
Fast | Low-latency work where cost and responsiveness matter most. |
High | More demanding review, synthesis, and reasoning work. |
Max | The most capable model for expensive or complex workflows. |
The web catalog is a UI convenience, not a backend allowlist. It includes:
| Provider | Models |
|---|---|
| Fireworks | accounts/fireworks/models/glm-5p2 (GLM 5.2), accounts/fireworks/models/deepseek-v4-pro, accounts/fireworks/models/deepseek-v4-flash |
| OpenAI | gpt-5.4-mini, gpt-5.4, gpt-5.5 |
| Anthropic | claude-haiku-4-5, claude-sonnet-4-6, claude-opus-4-6, claude-opus-4-7, claude-opus-4-8 |
DeepSeek models are reachable only through Fireworks (the two deepseek-v4-* entries above). DeepSeek-direct is no longer a selectable provider.
Default model
When an organization has not customized its LLM settings, all three tiers resolve to Fireworks GLM 5.2 (accounts/fireworks/models/glm-5p2) using Zeeq's internal default key and the Fireworks endpoint (https://api.fireworks.ai/inference/v1). Code reviews use the same default path.
Key Sources
Zeeq has two key paths:
| Key source | Where it lives | Who owns it | Current provider policy |
|---|---|---|---|
| Internal default key | Runtime configuration loaded into AppSettings:Llm:Models:*:ApiKey | Zeeq | Fireworks only |
| Managed key | Organization-scoped encrypted row in core_encrypted_values | Tenant organization | Required for OpenAI and Anthropic |
KeyId = null means "use the internal default key" only when the selected provider is Fireworks. OpenAI and Anthropic require a tenant-managed encrypted key before settings can be saved or tested.
Fireworks is an OpenAI-compatible chat API, so it routes through the same OpenAI SDK path as OpenAI, with the Fireworks endpoint supplied explicitly. Anthropic is not yet wired for chat client creation and is rejected as unsupported_provider if it reaches the runtime without a managed key path.
When no tenant-managed keys exist, the API key dropdown shows (Add managed key). That option opens the managed-key slideover and is not a persisted configuration value.
Managed Keys
The managed-key slideover supports:
| Action | Behavior |
|---|---|
| Add key | Sends plaintext once, encrypts it server-side, and returns metadata only. |
| Rename key | Updates display metadata without touching encrypted bytes. |
| Rotate key | Replaces the encrypted value for the same key ID, so tiers already using the key keep their reference. |
| Delete key | Soft-disables an unreferenced key. Referenced keys must be removed from all tiers first. |
Plaintext keys are write-only. The UI does not display plaintext after submit, does not store plaintext in local storage, and receives only key metadata from the API.
Testing Provider Access
Each tier has a Test action that checks the selected provider, model, and key source with a fixed server-side prompt. Users cannot supply arbitrary prompts from the UI.
The test endpoint returns sanitized status, latency, provider, model, and error metadata. It does not return generated text, raw provider responses, or any key material.
Local Development
Local development can work with only the Fast default API key configured in user secrets. That key is now a Fireworks API key:
dotnet user-secrets set "AppSettings:Llm:Models:Fast:ApiKey" "<fireworks-key>"
High and Max default keys fall back to Fast when their configured key values are blank, so a single Fireworks key covers all three tiers by default.
The default Fast, High, and Max models in appsettings.Development.json are accounts/fireworks/models/glm-5p2 with the endpoint https://api.fireworks.ai/inference/v1.
The development-only Fast smoke-test endpoint can be exercised with:
curl -X POST "http://zeeq-server.localhost:8095/api/v1/diagnostics/llm/fast-smoke-test"
That endpoint is anonymous only in Development and is not mapped in production.