On the Enterprise plan, admins can add the organization’s own provider API keys in Settings > Models. Calls to a provider with an organization key run on that key and don’t use credits. Your code doesn’t change: keep using
MAJOR_JWT_TOKEN, never the provider key.Example requests
- “Add a Summarize button that uses Claude to summarize the selected ticket.”
- “Classify each new lead as hot, warm, or cold with GPT and store the label.”
- “Generate a product image from the description field with Gemini.”
Enable it for an app
The proxy is enabled per app. When you enable it, the app gets a default monthly spending limit of $10.- Editor
- CLI
- Platform Agent
Open the app in the editor, go to the Settings tab, and turn on Enable AI proxy for this app in the AI Proxy section. You can change the monthly spending limit there.
Use it in your code
Two environment variables are available in the app’s runtime, in the editor preview, and after deploy:
Call the proxy from server code only, so the token never reaches the browser. Use the provider’s own SDK, not a unified SDK, and never hard-code keys or proxy URLs.
The proxy only accepts requests that come from Major’s network: the editor preview, deployed apps, and Major sandboxes. Requests from anywhere else, such as an app you run on your own machine, are rejected with
403.httpOptions.baseUrl to the /genai prefix only. The SDK adds /v1beta/models/... itself. Streaming (generateContentStream) and token counting (countTokens) use the same client.
Images and audio
Supported endpoints
Only these endpoints are available. Requests to any other path are rejected.
Not supported: embeddings, video generation, file uploads, the OpenAI Assistants API, and Gemini cached contents, tuning, and the Live API.
Spending limits and errors
Each request is checked before it reaches the provider:
The monthly limit counts only this app’s proxy usage and resets at the start of each month. Calls that run on your organization’s own provider keys count toward it at the provider’s list price.
If your organization uses its own key for a provider, two more cases can fail a request:
- The provider rejected the organization’s key (invalid, out of credits, over a spend limit, or suspended). The error names the provider and asks you to contact your organization admin. Requests on your own key never fall back to Major’s keys.
- An admin turned off the provider. Requests to a turned-off provider are refused.
Agents and the Platform Agent choose their models separately. See agent models and Settings > Models.