{{ __('Admin') }} {{ __('AI / API keys') }}
{{ __('Admin · System · AI providers') }}

AI {{ __('API keys') }}

{{ __('Global keys for every AI provider :app supports. Workspaces on plans without "Bring your own key" use these as the fallback. Encrypted at rest.', ['app' => \App\Models\SystemSetting::get('app_name', config('app.name', 'WaDesk'))]) }}

@if (session('success'))
{{ session('success') }}
@endif @if (session('error'))
{{ session('error') }}
@endif {{-- KPI strip --}}
{{ __('Providers') }}
{{ $stats['total'] }}
{{ __('seeded') }}
{{ __('Active') }}
{{ $stats['active'] }}
{{ __('enabled for fallback') }}
{{ __('Ready') }}
{{ $stats['ready'] }}
{{ __('active + has key') }}
{{ __('No key set') }}
{{ $stats['no_key'] }}
{{ __('paste a key to ready') }}
{{-- Provider cards — one per row --}} @forelse ($providers as $p)

{{ $p->name }}

{{ $p->is_active ? 'Active' : 'Disabled' }} @if (!empty($p->api_key)) {{ __('Key saved') }} @else {{ __('No key') }} @endif
provider: {{ $p->provider }} · default model: {{ $p->default_model ?: '—' }}
@csrf
@csrf @method('PATCH') @if (!empty($p->fields_schema))
@foreach ($p->fields_schema as $key => $spec) @php // Prefill the decrypted API key so the eye-reveal toggle // can show the saved value. Same security posture as the // payment-gateways credentials — admin already has full // access; this just removes the "type it again to see it" // friction. $existingVal = $key === 'api_key' ? (string) ($p->api_key ?? '') : $p->extra_config_decoded[$key] ?? ''; $hasApiKey = $key === 'api_key' && !empty($p->api_key); @endphp @endforeach
@endif
@empty
{{ __('No AI providers configured') }}

{{ __('Run') }} php artisan db:seed --class=AdminAiKeySeeder to populate.

@endforelse {{-- Help footer card --}}
{{ __('How these keys are used') }}

{{ __('Fallback chain') }}

When a workspace runs an AI feature, AiKeyResolver tries the workspace's own key first (only available on plans with BYOK enabled). If none is set, it falls back to the matching {{ __('Active') }} row here. Disabling a provider above means workspaces on non-BYOK plans simply can't use it.