Cloud providers take a key in Settings → Providers. porto validates the key with a cheap probe, then stores it encrypted when PORTO_ENCRYPTION_KEY is set. The secret never comes back over the WebSocket.
1

Open Settings → Providers

Click Add provider and pick a type. Only unconnected types appear (except Local / network, which you can add more than once).
2

Paste the key

Fill only the fields for that type. Some types also accept a custom base URL (OpenAI-compatible gateway).
3

Save, then add an agent

New agent turns use the stored key. You do not paste it again on Add agent.

​
Provider cards

Not the Grok CLI. Key from console.x.ai. Prefix xai-….
Key from platform.openai.com. Prefix sk-….
Key from console.anthropic.com. Prefix sk-ant-…. This is not Claude Code.
Google AI Studio key. Prefix AIza….
Key from platform.deepseek.com.
Key from console.mistral.ai. Same key as Mistral Vibe.
One key, many models. From openrouter.ai/keys. Prefix sk-or-….

​
Encryption at rest

setup.sh writes a PORTO_ENCRYPTION_KEY into backend/.env. With that set, keys go into the credentials table (AES-256-GCM), not plaintext on the agent row. Generate a key by hand if you skipped the wizard:
Restart the API after changing the encryption key. A new key cannot decrypt rows sealed with the old one.

​
Custom base URL

These types accept an override: openai, deepseek, xai, openrouter, ollama, local. Use it for a company gateway or a self-hosted OpenAI-compat proxy. For a machine that is only a local inference server, prefer Local / network.