Integrations · OpenAI
Guild agents call OpenAI’s GPT and o-series models through task.llm, with no API key in agent code. Guild holds the credential server-side, checks your model policies on every call, and attributes spend to the workspace, agent, and user that made it.
Book a demo
See how teams govern agents that use OpenAI.
Start free
Connect OpenAI and scope your first agent.
One request shape across GPT and o-series
Not every OpenAI model accepts the same reasoning parameters. Guild removes the ones a model doesn’t accept, so the sametask.llm request works across GPT and o-series models. Streaming responses always carry token usage, so every call is attributed to its session.
How it works
1
Add a credential
In Access & setup > Models & providers, click Add API key and choose a provider that serves GPT and o-series models. Check OpenAI under Models. On a managed account, you can skip this while Guild holds a managed OpenAI key.
2
Write a model policy
Bind the credential’s OpenAI access to the account, a workspace, or an agent, and list the models it may call, such as
gpt-5*.3
Call it from task.llm
Name
"openai" in llmPreferences, or leave preferences out and let your policies choose. Guild resolves the credential at runtime.Every GPT and o-series call goes through your policies
Agents never hold the key. Guild stores the credential server-side and shows only a masked value, so you can rotate it without touching agent code or the model policies bound to it. Policies are an allowlist: a workspace, agent, or installed agent can call a GPT and o-series model only if a rule allows it. Set a daily token limit to cap spend, and see each call by workspace, agent, and user in Usage. A raw API key in an agent’s environment reaches every model the key can. A policy reaches only the models you name.About OpenAI models on Guild
Inference providers
You can reach these models through the OpenAI API itself or through a third-party provider.
Write the canonical model name, such as
gpt-4o, everywhere in Guild. Guild maps it to each provider’s own model ID.
Models
Guild prices and recognizes these OpenAI model IDs. A policy or preference can also name any other model your credential can reach. Third-party providers route more models than this list, and their catalogs change; see each provider’s page for what it serves.Set up OpenAI
On a managed account, agents can use OpenAI models without a credential, as long as Guild holds a managed key for OpenAI. To use your own OpenAI account instead, add a credential. Adding your first credential switches the whole account to bring your own key (BYOK).1
Open Models & providers
Click Access & setup in the left nav, then Models & providers. In an organization, only admins can open it.
2
Add a credential
Click Add API key and choose an inference provider from the table above.
3
Enter the provider's secret
Give the credential a Name and paste your provider’s API key. AWS Bedrock asks for an IAM role and region instead.
4
Choose OpenAI
Under Models, check OpenAI. Keep
gpt-4o as its default model or enter another from the list above. Then click Add Key. On Fireworks AI, pick a model from its list, because the pre-filled default isn’t available there.--models "gpt-5*" limits a policy to matching models:
Use it from an agent
Agent code never names a credential. Guild resolves the call against the workspace owner’s settings. To ask for OpenAI explicitly, put it inllmPreferences:
gpt-5. The second falls back to the default model of the matching policy. Preferences are strict: if no credential or policy allows any of them, the call fails rather than using another publisher. See LLM preferences.
Notes
- OpenAI streaming responses always include token usage, so Guild can attribute spend to the session.
- Guild removes reasoning parameters a model doesn’t accept, so the same request works across GPT and o-series models.
- The Codex runtime driver calls the OpenAI Responses API through the runtime, so it needs an OpenAI credential or managed OpenAI access.
Frequently asked questions
Can Guild agents use GPT models without my own OpenAI key?
Can Guild agents use GPT models without my own OpenAI key?
Yes, on a managed account, when Guild holds a managed key for OpenAI. Usage then draws from your Guild tokens balance. Adding any credential switches the whole account to bring your own key (BYOK).
Can I call gpt-oss through the OpenAI API?
Can I call gpt-oss through the OpenAI API?
No. The open-weight
gpt-oss models are served by Fireworks AI and AWS Bedrock, not the OpenAI API.Can I limit an agent to the GPT-5 family?
Can I limit an agent to the GPT-5 family?
Yes. Add a model policy for the agent with
--models "gpt-5*". Policies are an allowlist, so the agent can call only matching models.What does the Codex runtime need?
What does the Codex runtime need?
An OpenAI credential or managed OpenAI access. The Codex runtime driver calls the OpenAI Responses API through the runtime.
Put a governed agent on OpenAI this week
Book a demo
See how teams govern agents that use OpenAI.
Start free
Connect OpenAI and scope your first agent.