# API & Deployment Configuration

Source: https://docs.ops0.com/docs/settings/api-configuration

Configure AI provider API keys, deployment concurrency limits, timeout settings, and LLM audit logging for your ops0 organization.

---

## AI Provider — Claude

ops0 uses Anthropic Claude as its primary AI provider, powering all AI-driven features. You need a Claude API key to use any of these features.

### Get your API key
Go to [console.anthropic.com](https://console.anthropic.com) → **API Keys** → **Create Key**. Copy the key — it is only shown once.

### Open API Configuration
In ops0, navigate to **Settings** → **API Configuration**.

### Enter and test the key
Paste your key into the **Claude API Key** field, then click **Test Connection** to verify it is valid and has sufficient credits.

### Save
Click **Save API Settings**. The key is masked immediately and encrypted at rest — you cannot retrieve the full value again. Store it somewhere safe before saving.

| Field | Description |
|-------|-------------|
| **Claude API Key** | Your Anthropic API key (`sk-ant-...`) |
| **Test Connection** | Verifies the key is valid and has sufficient credits before saving |

### Features powered by Claude

- [IaC Generation](https://docs.ops0.com/docs/iac): Generate Terraform and OpenTofu code from natural language descriptions.

- [Kiwi AI Chat](https://docs.ops0.com/docs/query-console): Conversational assistant for querying and understanding your infrastructure.

- [Discovery AI](https://docs.ops0.com/docs/discovery): AI-generated summaries and analysis of discovered cloud resources.

- [Ansible Generation](https://docs.ops0.com/docs/configurations): Generate Ansible playbooks from natural language task descriptions.

---

## Alternative AI Provider — OpenAI

ops0 also supports OpenAI-compatible APIs as an alternative or supplemental AI provider. This is useful for organizations that:

- Already have OpenAI API credits or enterprise agreements
- Use **Azure OpenAI Service** through a Microsoft enterprise agreement
- Want to run a **local model** via Ollama or vLLM without sending data to external providers
- Have a private inference endpoint behind a firewall

| Field | Description | Example |
|-------|-------------|---------|
| **OpenAI API Key** | Your OpenAI API key | `sk-...` |
| **Base URL** | API endpoint — leave blank to use the OpenAI default | `https://YOUR-RESOURCE.openai.azure.com` |

### Common configurations

**OpenAI (default cloud)**
Leave **Base URL** blank and enter your `sk-...` API key. ops0 will call `api.openai.com` directly.

**Azure OpenAI Service**
Set **Base URL** to your Azure endpoint (e.g. `https://YOUR-RESOURCE.openai.azure.com`) and enter your Azure API key. No trailing slash.

**Ollama (local inference)**
Set **Base URL** to `http://localhost:11434/v1`. Leave **API Key** blank or enter `ollama`. No data leaves your environment.

**vLLM or other OpenAI-compatible endpoint**
Set **Base URL** to your endpoint's base URL and enter the appropriate API key if your server requires one.

**Provider Priority**

When both a Claude API key and an OpenAI API key are configured, ops0 uses Claude by default for all features. OpenAI is used as a fallback only when Claude is unavailable or returns an error.

---

## Deployment Settings

Control how ops0 executes Terraform and OpenTofu deployments across your organization.

| Setting | Default | Range | Description |
|---------|---------|-------|-------------|
| **Max Concurrent Deployments** | 5 | 1–20 | Maximum number of plan and apply operations running simultaneously across all projects |
| **Deployment Timeout** | 300 seconds | 60–3600 | Maximum time a plan or apply can run before being cancelled and marked as failed |

### Max Concurrent Deployments

This setting limits how many `plan` and `apply` operations ops0 will run at the same time, across all projects and all users in your organization.

**Increase** this value if:
- Multiple teams are running deployments simultaneously and jobs are spending time in the queue
- Your cloud provider accounts have high API rate limits

**Decrease** this value if:
- Your cloud provider is returning throttling or rate-limit errors during busy periods
- You want to reduce the blast radius of concurrent changes during sensitive windows

### Deployment Timeout

The timeout applies to both `terraform plan` and `terraform apply` operations. A deployment that exceeds the timeout is cancelled and marked as **failed** — no partial state is committed.

The default of 300 seconds (5 minutes) is sufficient for most deployments. Increase toward 3600 (1 hour) for large Terraform projects that provision many resources in a single apply — for example, an initial environment build that creates VPCs, subnets, RDS instances, EKS clusters, and supporting IAM roles in one run.

**Timeouts Cancel In-Progress Operations**

When the timeout is reached, ops0 sends a termination signal to the running Terraform process. Cloud resources that were partially provisioned during the apply are not automatically destroyed. Review your Terraform state after a timeout and clean up any orphaned resources manually.

---

## LLM Audit Logging

When enabled, ops0 records the full input and output of every LLM call made on behalf of your organization — including the prompts sent to Claude or OpenAI and the model responses received.

### Enable the toggle
Go to **Settings** → **API Configuration** → toggle **Enable LLM I/O Logging** to on.

### Save
Click **Save API Settings**. Logging takes effect immediately for all subsequent LLM calls.

### View logs
Navigate to **Settings** → **Audit Logs** and filter by type **LLM** to see all recorded calls.

### What is logged

Every LLM call record includes:

| Field | Description |
|-------|-------------|
| **Feature** | The ops0 feature that triggered the call, such as `iac_generate`, `discovery_generate`, `k8s_incidents`, or `kiwi_chat` |
| **Model** | The model name and version that processed the request |
| **Input tokens** | Prompt token count, including any cache read tokens |
| **Output tokens** | Completion token count |
| **Duration** | Time in milliseconds from request to first response token |
| **Status** | `success` or `error` with error message if applicable |
| **Full prompt** | Complete prompt text (only when LLM I/O logging is enabled) |
| **Full completion** | Complete model response text (only when LLM I/O logging is enabled) |

**Prompts May Contain Sensitive Infrastructure Data**

LLM I/O logging captures the full content of every prompt. Prompts sent by ops0 features routinely contain your Terraform code, resource names, cloud account identifiers, configuration file contents, and other infrastructure details. Enable this setting only if you require a complete audit trail and have reviewed your data-handling and retention policies for this category of data.

---

## Key Security

All API keys stored in ops0 are protected by the following controls:

- **Encrypted at rest** — Keys are encrypted using AES-256-GCM before being written to the database. The encryption key is not stored alongside the data.
- **Masked after saving** — Once saved, the full key value is never returned by the API or shown in the UI. The settings page displays only a masked representation such as `sk-ant-...***`.
- **Never exported** — API keys are excluded from all audit log exports, backup exports, and data portability downloads.
- **Rotation** — To rotate a key, paste the new value into the field and save. The old key is replaced immediately and any subsequent LLM calls use the new key.

**Lost Keys Cannot Be Recovered**

If you lose a key after saving, you cannot retrieve it from ops0. Generate a new key in the provider console (Anthropic Console or OpenAI dashboard), paste it into ops0, and save. Revoke the old key in the provider console to prevent unauthorized use.

---

## LLM Usage Metrics

Navigate to **Settings → API Configuration → LLM Usage** to view a dashboard of all AI activity across your organization.

### What the Dashboard Shows

| Metric | Description |
|--------|-------------|
| **Total calls** | Number of LLM requests in the selected time window |
| **Total tokens** | Input + output tokens consumed |
| **By feature** | Token usage per ops0 feature (`iac_generate`, `discovery_generate`, `k8s_incidents`, `kiwi_chat`, etc.) |
| **By model** | Usage split across Claude Sonnet, Claude Haiku, and any OpenAI-compatible models |
| **By provider** | Anthropic vs OpenAI total calls and tokens |
| **Time series** | Daily call volume and token usage over the selected period |

### Filtering

- **Date range** — any period (default: last 7 days)
- **Feature** — filter to a single ops0 feature
- **Model** — filter to a specific model

### LLM Call Logs

The **Logs** tab shows individual call records:

| Field | Description |
|-------|-------------|
| **Timestamp** | When the call was made |
| **Feature** | The ops0 feature that triggered it |
| **Model** | Model name and provider |
| **Input tokens** | Prompt size (including cache read tokens) |
| **Output tokens** | Completion size |
| **Duration** | Latency in milliseconds |
| **Status** | Success or error |
| **Full prompt / response** | Only visible when LLM I/O Logging is enabled |

Click any row to see full call detail. Full prompt and completion text are shown only when LLM I/O Logging is enabled.

---

## Efficiency

Navigate to **Settings → API Configuration → Efficiency** for a dedicated view of how efficiently ops0 uses tokens — separate from the raw usage numbers in LLM Usage Metrics above.

### Efficiency Benchmark

Runs an identical set of tasks twice — once with ops0's context, once with a direct coding agent and no ops0 context — and compares token usage. The result is a multiplier ("N.Nx avg fewer tokens") with a confidence range across trials.

**Runs in the background**

A benchmark run can take a few minutes. You can navigate away and come back — the last completed result stays visible and updates in place when a re-run finishes.

### Savings to Date

Stat cards summarizing cumulative token and cost savings attributable to ops0's context efficiency, based on completed benchmark runs.

### Prompt Optimization

Two tools for improving prompt quality org-wide:

| Tool | What it does |
|------|---------------|
| **Score a prompt** | Paste any prompt to get an instant 0–100 score, a breakdown across three dimensions (scope clarity, specificity, conciseness), and specific token-saving suggestions |
| **Org prompt health** | Average prompt score across your organization for the selected time window, plus a table of the top recurring opportunities to improve prompts and how many estimated tokens each would save |

### Where Tokens Go

A per-feature breakdown — tokens, call count, and cost — sorted by volume, for the selected time window.

---

## Related

- [Audit Logs](https://docs.ops0.com/docs/settings/audit-logs): View and filter all activity in your organization, including LLM call records.

- [Billing](https://docs.ops0.com/docs/billing): Monitor AI token usage and costs across your organization.

- [Organization](https://docs.ops0.com/docs/settings/organization): Manage organization name, description, and general settings.