> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guild.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on a user's behalf in Guild, use the Guild REST API at https://api.guild.ai/v1.
> The OpenAPI spec is unauthenticated: https://docs.guild.ai/openapi.json (or openapi.yaml).
> Authenticate with an account API key, sent as HTTP Basic (key id as username, secret as password) or as `Authorization: Bearer <api_key_id>:<api_key_secret>`. See https://docs.guild.ai/api-reference/introduction#authentication.
> To run one agent on demand without account-wide access, use an API trigger instead: https://docs.guild.ai/platform/api-triggers.
> To search these docs from an MCP client, connect to https://docs.guild.ai/mcp. The full page index is https://docs.guild.ai/llms.txt.

# Run GLM models from Z.ai in Guild agents under policy

> Call Z.ai's GLM models from Guild agents through AWS Bedrock, OpenRouter, or Fireworks AI, with model policies on every workspace and agent.

Integrations · Z.ai

Guild agents call Z.ai's GLM models through `task.llm`, using a credential for AWS Bedrock, OpenRouter, or Fireworks AI. Guild holds the credential server-side, checks your model policies on every call, and attributes spend to the workspace, agent, and user that made it.

> **[Book a demo](https://guild-ai.cal.com/gtm/meeting-with-guild.ai)**
>
> See how teams govern agents that use Z.ai.

> **[Start free](https://app.guild.ai)**
>
> Connect Z.ai and scope your first agent.

## GLM through the provider you already run

GLM models reach Guild only through third-party inference providers. `glm-5.3` is on Bedrock in all four supported US regions and on Fireworks AI, which adds `glm-5.3-flash` and `glm-5.2`. The default, `glm-5`, is on Bedrock outside `us-west-1`. OpenRouter serves its `z-ai/` namespace.

## How it works

**1. Add a credential**

In **Access & setup > Models & providers**, click **Add API key** and choose AWS Bedrock, OpenRouter, or Fireworks AI. Check **Z.ai** under **Models**.

**2. Write a model policy**

Bind the credential's Z.ai access to the account, a workspace, or an agent, and list the models it may call, such as `glm-*`.

**3. Call it from task.llm**

Name `"zai"` in `llmPreferences`, or leave preferences out and let your policies choose. Guild resolves the credential at runtime.

## Every GLM call goes through your policies

Agents never hold the key. Guild stores the credential server-side and shows only a masked value, so you can rotate it without touching agent code or the [model policies](/platform/llm-settings#model-policies) bound to it. Policies are an allowlist: a workspace, agent, or installed agent can call a GLM model only if a rule allows it. Set a [daily token limit](/platform/llm-settings#daily-token-limit) to cap spend, and see each call by workspace, agent, and user in [Usage](/insights/usage).

A raw API key in an agent's environment reaches every model the key can. A policy reaches only the models you name.

## About Z.ai models on Guild

| | |
| - | - |
| Name under **Models** in the credential form | Z.ai |
| `provider` in `llmPreferences` | `"zai"` |
| Default model | `glm-5` |
| Managed access | No. Add your own credential (BYOK). |

## Inference providers

Z.ai models are served only through third-party inference providers, not a Z.ai API.

| Provider | Notes |
| - | - |
| [AWS Bedrock](/platform/providers/aws-bedrock) | Serves `glm-5.3` in all four US regions, and `glm-5`, `glm-4.7`, and `glm-4.7-flash` except in `us-west-1`. |
| [OpenRouter](/platform/providers/openrouter) | Served under OpenRouter's `z-ai/` namespace. |
| [Fireworks AI](/platform/providers/fireworks) | Serves `glm-5.3`, `glm-5.3-flash`, and `glm-5.2`. |

Write the canonical model name, such as `glm-5`, everywhere in Guild. Guild maps it to each provider's own model ID.

## Models

Guild prices and recognizes these Z.ai model IDs. A policy or preference can also name any other model your credential can reach. Third-party providers route more models than this list, and their catalogs change; see each provider's page for what it serves.

| Model | Notes |
| - | - |
| `glm-5` | The default. |
| `glm-4.7` | |
| `glm-4.7-flash` | |
| `glm-5.3` | Served by Fireworks AI. |
| `glm-5.3-flash` | Served by Fireworks AI. |
| `glm-5.2` | Served by Fireworks AI. |

## Set up Z.ai

Guild has no managed key for Z.ai. To use Z.ai models, add a credential for a provider that serves them. Adding your first credential switches the whole account to bring your own key (BYOK).

**1. Open Models & providers**

Click **Access & setup** in the left nav, then **Models & providers**. In an organization, only admins can open it.

**2. Add a credential**

Click **Add API key** and choose an inference provider from the table above.

**3. Enter the provider's secret**

Give the credential a **Name** and paste your provider's **API key**. [AWS Bedrock](/platform/providers/aws-bedrock) asks for an IAM role and region instead.

**4. Choose Z.ai**

Under **Models**, check **Z.ai**. Keep `glm-5` as its default model or enter another from the list above. Then click **Add Key**. On [Fireworks AI](/platform/providers/fireworks), pick a model from its list, because the pre-filled default isn't available there.

To control which workspaces and agents can use Z.ai models, add a [model policy](/platform/llm-settings#model-policies) for the credential. For example, `--models "glm-*"` limits a policy to matching models:

```bash theme={null}
guild llm policy create --credential <credential-id> --publisher ZAI --target-id <workspace-or-agent-id> --models "glm-*"
```

## Use it from an agent

Agent code never names a credential. Guild resolves the call against the workspace owner's settings. To ask for Z.ai explicitly, put it in `llmPreferences`:

```typescript theme={null}
const result = await task.llm.generateText({
  prompt: "Summarize this text...",
  llmPreferences: [
    { provider: "zai", model: "glm-4.7-flash" },
    { provider: "zai" },
  ],
})
```

The first entry asks for `glm-4.7-flash`. The second falls back to the default model of the matching policy. Preferences are strict: if no credential or policy allows any of them, the call fails rather than using another publisher. See [LLM preferences](/guide/llms#llm-preferences).

> [!NOTE]
>
> The `"zai"` provider value needs `@guildai/agents-sdk` 0.7.6 or later.

## Frequently asked questions

> **Can I use GLM with Guild's managed tokens?**
>
> No. Guild has no managed key for Z.ai. Add a credential for a provider that serves it, which switches the account to bring your own key (BYOK).

> **Can I connect the Z.ai API directly?**
>
> No. Guild serves GLM models only through AWS Bedrock, OpenRouter, and Fireworks AI.

> **Why does my Fireworks AI credential fail with the default model?**
>
> The pre-filled default, `glm-5`, isn't on Fireworks AI. Pick a model from its list, such as `glm-5.3`, before you save.

> **What SDK version do I need?**
>
> `@guildai/agents-sdk` 0.7.6 or later, for the `"zai"` provider value in `llmPreferences`.

## Put a governed agent on Z.ai this week

> **[Book a demo](https://guild-ai.cal.com/gtm/meeting-with-guild.ai)**
>
> See how teams govern agents that use Z.ai.

> **[Start free](https://app.guild.ai)**
>
> Connect Z.ai and scope your first agent.

## Related

**Also runs on Guild:** [Moonshot AI](/integrations/moonshot) · [Qwen](/integrations/qwen) · [AWS Bedrock](/integrations/aws-bedrock) · [Fireworks AI](/integrations/fireworks)

**Read:** Docs: [Models & providers](/platform/llm-settings) · [LLMs](/guide/llms) · [Usage](/insights/usage)