Bring your own models.
Bring your own models.
Use any LLM from OpenAI, Anthropic, OpenRouter, Groq, or other supported cloud providers. BYOK — encrypted, bypasses usage limits.
How it works
Rixel runs scans and fix agents using LLMs. By default it uses managed models. With Custom Provider you add your own keys in Settings → Models — any supported cloud provider endpoint works. When a custom provider is set as preferred, all scan and fix jobs automatically use it.
Cloud provider
OpenAI-compatible API
AES-256-GCM
Encrypted with SECRETS_ENCRYPTION_KEY
Bypasses limits
Your key, your quota
Why bring your own provider
- Cost control: Use your existing OpenAI / Anthropic contracts and volume discounts.
- Model choice: Prefer Claude 3.5 Sonnet for reasoning, GPT-4o for speed, or Groq for latency — switch anytime.
- Data locality: Point to Azure OpenAI or other enterprise cloud endpoints for compliance.
- No rate-limit surprises: Your key means scans won’t count against Rixel’s managed quota.
Quick start
- Go to Settings → Models
- Click Add custom provider → choose preset (OpenAI, Anthropic, OpenRouter, Groq, Custom).
- Fill
Base URL,API key,Model name - Click Test connection → Save → set as Preferred.
- Run a scan — logs will show
provider: customand bypass usage limits.
Env required
Custom providers need SECRETS_ENCRYPTION_KEY — a 32-byte base64 string for AES-256-GCM. Set it in .env before starting server, otherwise the API returns 500.
# generate:
openssl rand -base64 32
# .env
SECRETS_ENCRYPTION_KEY="your_base64_key"Providers at a glance
Security
Keys are encrypted client-side payload → server-side AES-256-GCM with SECRETS_ENCRYPTION_KEY. Never logged, never returned in API responses.
- Encrypted column: Prisma + custom AES middleware
- Scope: per-user, only owner can read/decrypt usage
- Rotation: delete old provider → add new, scans pick up immediately