task.llm. By default, agents use managed LLM access backed by your Guild tokens balance. You can switch to bring your own key (BYOK) by adding a provider API key.
LLM configuration is stored on an account (your user account or an organization), not on individual workspaces. Sessions in a workspace use the LLM settings for that workspace’s owner account.
Open LLM settings
The console Settings panel lists LLM Settings after Credentials and before Usage.Personal account
1
Open Settings
Click your profile in the top-left corner, then select Settings.
2
Go to LLM Settings
In the settings sidebar, click LLM Settings.
https://app.guild.ai/settings/llm-settings
Organization
Organization LLM settings apply to workspaces owned by that organization. Only organization admins can open this section.1
Open your organization
Switch to the organization from the profile menu.
2
Open Settings
Go to Settings for the organization.
3
Go to LLM Settings
In the settings sidebar, click LLM Settings.
https://app.guild.ai/organizations/{org-name}/settings/llm-settings
Managed vs BYOK
The page shows your current mode as LLM Tier:
- Managed () — Guild runs LLMs on your behalf using managed infrastructure.
- BYOK (Bring Your Own Key) — Guild routes LLM calls through your default API key.
API keys
Provider API keys live on the account. Adding one switches the account to BYOK; removing the last one returns it to managed.Add an API key
Click Add API key in the page header.
The platform default model for each provider is:
Guild stores keys securely and shows only a masked value in the table (first and last few characters).
Update an API key
Select Edit from the row menu to update an existing key.Default model
Each API key has a default model — the model used when that key is selected but the request doesn’t resolve to a more specific allowed model. It is set when you add the key (pre-filled with the platform default for the provider) and can be changed later from the key’s row.Manage keys
The keys table lists each key’s provider, masked API key, created date, and creator. Use the row menu to:- Set as default — Use this key for LLM calls when multiple keys exist.
- Delete — Archive the key. Archived keys appear when you filter to Archived keys.
Model policies
Model policies control which LLMs agents can call. A policy (a “rule”) attaches an API key to a scope with a set of allowed models. Policies are an allowlist: a model is available only if a matching rule allows it. Model policy configuration is available only in BYOK mode. The Account default and Overrides sections, along with the workspace-level and workspace agent-level Models sections, appear only when the account has at least one active API key. In managed mode, these sections are hidden because LLM calls use Guild-provided tokens and there are no rules to assign.Account default
Set the account default rules under Models in Settings > LLM Settings. Rules are ranked, and the first matching rule wins. Each rule allows one of:
For a Specific models rule, you can:
- Select standard models from the built-in catalog.
- Enter custom globs to match model families, for example
haiku-*orgpt-4o-*.
Overrides
The Overrides section, below Models in Settings > LLM Settings, lists every workspace, agent, and workspace-agent that sets its own rules instead of the account default. An override replaces the account default entirely — there is no merging. Filter the list by scope — Workspaces, Agents, or Workspace agents — and use Add override to create one or the row menu to edit it. Reset all overrides clears every override and returns all scopes to the account default. Like Models, this section is hidden on the LLM Settings page in managed mode and appears once the account has at least one active API key.Rule hierarchy and inheritance
Model rules resolve down an inheritance chain so you can set a policy once and refine it where needed, from least to most specific:API keys themselves are always inherited from the owning account and cannot be replaced at a lower level. Only model rules can be overridden.
- Workspace — open the workspace and click Models in the sidebar. The page shows the inherited account rules; Add rule overrides them for this workspace, and Reset to inherited drops the override. If the owning account has no active API keys, this page shows an empty state — Using Guild-provided tokens — instead of the editor, and model controls become available once you add an API key to the account.
- Workspace agent — open the agent inside a workspace and use the Models section on its detail page. It works the same way, overriding the rules for that agent in that workspace. If the owning account has no active API keys, the Models section is hidden entirely.
Manage policies from the CLI
The Guild CLI manages model policies underguild llm policy. Each policy attaches an API key to a target — a workspace, agent, or workspace-agent — with an optional model allowlist.
Model values follow the same semantics as the console: a list of patterns (with optional
* wildcards) allows those models, all models means unrestricted, and an empty list disables the key for that target.
Daily token limit
When you use BYOK, you can set a Daily token limit below the keys table. All LLM requests are rejected after the account exceeds this limit for the day. The limit resets at midnight UTC. Leave the field empty for unlimited usage. This limit applies to LLM usage on the account while BYOK is active.Guild tokens balance
When the account is in managed mode, the page shows your Guild tokens balance. The balance is indicative and may not update in real time.How agents use these settings
Agents do not embed provider API keys in code. At runtime, Guild resolves LLM configuration for each session from the workspace owner’s account settings. See LLMs for callingtask.llm from agent code and Credentials for connecting third-party services agents use as tools.