LLM Models - Overcut.ai

Overcut ships with a set of system-managed models, but you can bring your own API keys (BYOK) to connect models from any supported provider. Custom models are configured once at the workspace level and can then be assigned to individual agents, workflows, or set as the workspace default.

Overview

LLM Models page showing configured provider cards and the Add LLM Model button

Bring Your Own Key

Connect your existing API keys from OpenAI, Anthropic, Azure, AWS Bedrock, or OpenRouter.

Per-Agent Control

Assign a specific model to each agent: use a fast model for triage and a powerful model for code review.

Cascade Defaults

Set defaults at the workspace, workflow, or agent level. Agents inherit the closest configured default automatically.

Encrypted Storage

API keys are encrypted at rest and never exposed in the UI, logs, or to the LLM itself.

Supported Providers

Provider	Config Type	Notes
OpenAI	API key + model name	Supports optional gateway settings for proxies and compatible APIs
Azure OpenAI	API key + endpoint + deployment	Standard Azure OpenAI Service. Supports extra static headers
Azure OpenAI (Responses API)	API key or token + model + endpoint	Azure-native Responses API with full gateway settings
Anthropic	API key + model name	Claude models via Anthropic’s API directly
AWS Bedrock	Region + credentials	Claude models and others via AWS Bedrock Converse API
OpenRouter	API key + model name	Access 200+ models. Supports optional gateway settings

Creating a Custom Model

Open LLM Models

Navigate to LLM Models in the main menu.

Create a new model

Click the Add LLM Model button. Enter a display name (e.g. “Claude Sonnet for Production”) and select a provider.

Configure the provider

Fill in the provider-specific configuration. Each provider requires different fields. For gateway-backed providers, configure endpoint, auth, and header settings only when your gateway requires them. See the Provider Configuration section below.

Save

Overcut validates the required fields, encrypts your API key or token, and stores the model. It is now available for assignment.

Once a model is created, the provider and model key cannot be changed. To switch providers, create a new model and reassign your agents.

Provider Configuration

OpenAI

API Key

required

Your OpenAI API key.

Model

required

The model identifier (e.g. gpt-4.1, gpt-4o, o3).

Base URL

Optional. Overrides the API endpoint for proxies, gateways, or OpenAI-compatible endpoints.

For gateway authentication and header options, see Gateway and Custom Endpoint Settings.

Azure OpenAI

API Key

required

Your Azure OpenAI resource key.

Endpoint

required

The Azure OpenAI resource URL (e.g. https://your-resource.openai.azure.com).

Deployment Name

required

The name of the deployed model in your Azure resource.

API Version

required

The Azure OpenAI API version (e.g. 2024-02-15-preview).

For static gateway headers, see Gateway and Custom Endpoint Settings.

Azure OpenAI (Responses API)

API Key / Token

required

Your Azure OpenAI key or the gateway token your endpoint expects.

Model

required

The model deployment name to use.

Base URL

required

Your Azure OpenAI resource endpoint with the /openai path (e.g. https://your-resource.cognitiveservices.azure.com/openai).

API Version

required

The API version (e.g. 2025-04-01-preview).

Use Responses API

Choose Yes to use the Responses API format, or No when your endpoint expects the non-Responses format.

For gateway authentication and header options, see Gateway and Custom Endpoint Settings.

Anthropic

API Key

required

Your Anthropic API key.

Model

required

The Claude model identifier (e.g. claude-sonnet-4-20250514, claude-opus-4-20250514).

AWS Bedrock

Access Key ID

required

Your AWS access key ID.

Secret Access Key

required

Your AWS secret access key.

Region

required

The AWS region where your Bedrock models are available (e.g. us-east-1).

Model

required

The Bedrock model ID (e.g. anthropic.claude-3-sonnet-20240229-v1:0).

OpenRouter

API Key

required

Your OpenRouter API key.

Model

required

The OpenRouter model identifier, in provider/model format (e.g. anthropic/claude-sonnet-4, openai/gpt-4.1).

Base URL

Optional. Overrides the default OpenRouter endpoint when you use a compatible gateway.

For gateway authentication and header options, see Gateway and Custom Endpoint Settings.

Gateway and Custom Endpoint Settings

Gateway settings appear only for providers that support OpenAI-compatible endpoints or static gateway headers. Use them when your provider traffic must pass through a proxy, API gateway, Azure API Management, or another OpenAI-compatible endpoint.

Field	Appears for	Use it when
Base URL	OpenAI, OpenRouter, Azure OpenAI (Responses API)	You need to send requests to a proxy, gateway, custom endpoint, or compatible API instead of the provider’s default endpoint.
Auth method	OpenAI, OpenRouter, Azure OpenAI (Responses API)	Your gateway expects the API credential in a specific authentication header.
Custom auth header name	OpenAI, OpenRouter, Azure OpenAI (Responses API)	You choose Custom header in Auth method and need to name the header that carries the credential.
Extra headers (JSON)	OpenAI, OpenRouter, Azure OpenAI, Azure OpenAI (Responses API)	Your gateway requires static routing headers, tenant headers, or other fixed headers on every request.
Use Responses API	Azure OpenAI (Responses API)	You need to choose whether the endpoint uses the Responses API format.

Auth method choices

For OpenAI, OpenRouter, and Azure OpenAI (Responses API), choose the Auth method that matches your endpoint or gateway:

Bearer token (Authorization header): Sends the credential in the Authorization bearer header. This is the default choice for OpenAI-compatible endpoints.
api-key header: Sends the credential in the api-key header. Use this when Azure OpenAI or your gateway expects an api-key header.
Custom header: Sends the credential under the header you enter in Custom auth header name.

When you choose Custom header, fill in Custom auth header name with the exact header name your gateway expects, such as x-api-key. Overcut requires this field when Auth method is Custom header.

Extra headers (JSON)

Use Extra headers (JSON) for static headers that should be sent with every request to the endpoint. The value must be a JSON object. Header names and header values must both be strings.

{
  "X-Tenant-Id": "acme",
  "X-Gateway-Route": "production"
}

Do not use Extra headers (JSON) for the primary API credential when Auth method can represent it. Use Auth method and Custom auth header name for the credential header, then use Extra headers (JSON) for additional fixed headers.

Assigning Models

Per-Agent

Each agent has a model selector in its settings. Choose a specific model or leave it on Default Model to inherit from the workflow or workspace.

Open the agent

Navigate to Agent Roles and select an agent.

Select a model

Use the Model dropdown to pick a custom model or Default Model.

Per-Workflow

Set a workflow-level default in the Workflow Builder so all agents in that workflow inherit the same model unless they have their own override.

Open Workflow Settings

Click the canvas background to open Workflow Settings.

Set Default LLM Model

Select a model from the Default LLM Model dropdown.

Per-Workspace

Set a workspace-wide default in Account → Settings. All workflows and agents that don’t specify their own model will use this default.

Inactive Models

Set a model to inactive when you want to stop it from being selected without losing its configuration. Inactive models remain visible in LLM Models so you can review them, edit their details, or reactivate them: open the model and use the Inactive control to switch it back to Active. Inactive models are hidden anywhere a model is selected: agent Model dropdowns, workflow Default LLM Model dropdowns, and the workspace default model picker.

Model Cascade

When an agent executes, Overcut resolves its model by walking down this cascade and using the first configured value:

Coordinator override: coordinatorModelKey on an agent.session step (applies only to the coordinator, never to child agents)
Agent model: the agent’s own model selection
Workflow default: the Default LLM Model set in Workflow Settings
Workspace default: configured in Account → Settings
System default: Overcut’s managed default model

For a step-by-step walkthrough of configuring defaults at each level, see the Default Model Configuration guide.

Overcut Agent vs. Claude Code

Overcut supports two execution engines. The engine is selected per workflow step in the Workflow Builder.

Overcut Agent (default)

The default engine. Runs on Overcut’s agent architecture with full model flexibility.

Model selection: Follows the cascade described above. You control exactly which model each agent uses.
Providers: Any supported provider (OpenAI, Azure, Anthropic, AWS Bedrock, OpenRouter)
API keys: Uses workspace-configured custom models, or Overcut’s system models if no custom model is set
Billing: Through Overcut when using system models, or directly against your provider when using custom models

Claude Code (Claude Agent SDK)

An alternative engine that runs Anthropic’s Claude Code Agent SDK directly.

Model selection: Automatic. The Claude SDK chooses the optimal model. No model configuration is available.
Providers: Anthropic only
API keys: Requires your own Anthropic API key, configured in Security → Workspace Secrets
Billing: Directly against your Anthropic account

When to Use Each

Scenario	Recommended Engine
You need to use a specific model or provider (e.g. GPT-4.1, Azure, Bedrock)	Overcut Agent
You want model selection controlled per agent/workflow/workspace	Overcut Agent
You want to leverage Claude Code’s native coding capabilities	Claude Code
You already have an Anthropic API key and want direct billing	Claude Code

Custom model selection (BYOK) applies only to the Overcut Agent engine. The Claude Code engine always uses Claude’s automatic model selection with your Anthropic API key.

Both engines support MCP Servers, the same agent roles, and the same Overcut tools (ticketing, pull requests, git operations). The difference is in model selection and the underlying execution architecture.

Security

API keys are encrypted at rest and never returned through the UI or API.
Decrypting a model’s configuration requires the llmModel.readEncryptedConfig permission.
System models (managed by Overcut) cannot be edited or deleted by workspace users.

Next Steps

Default Model Configuration: Step-by-step guide for setting workspace, workflow, and coordinator defaults
Claude Agent SDK Integration: Detailed setup guide for the Claude Code engine
Vault: Manage secrets used across your workspace
Core Building Blocks: Understand how agents, actions, and triggers connect

​Overview

Bring Your Own Key

Per-Agent Control

Cascade Defaults

Encrypted Storage

​Supported Providers

​Creating a Custom Model

​Provider Configuration

​OpenAI

​Azure OpenAI

​Azure OpenAI (Responses API)

​Anthropic

​AWS Bedrock

​OpenRouter

​Gateway and Custom Endpoint Settings

​Auth method choices

​Extra headers (JSON)

​Assigning Models

​Per-Agent

​Per-Workflow

​Per-Workspace

​Inactive Models

​Model Cascade

​Overcut Agent vs. Claude Code

​Overcut Agent (default)

​Claude Code (Claude Agent SDK)

​When to Use Each

​Security

​Next Steps

Overview

Supported Providers

Creating a Custom Model

Provider Configuration

OpenAI

Azure OpenAI

Azure OpenAI (Responses API)

Anthropic

AWS Bedrock

OpenRouter

Gateway and Custom Endpoint Settings

Auth method choices

Extra headers (JSON)

Assigning Models

Per-Agent

Per-Workflow

Per-Workspace

Inactive Models

Model Cascade

Overcut Agent vs. Claude Code

Overcut Agent (default)

Claude Code (Claude Agent SDK)

When to Use Each

Security

Next Steps