For Organisation Admins: This page is for managing credentials across multiple workspaces. To use AI models in your workspace, see the Model Catalog documentation.
- Save time: Store API keys once, use in many workspaces
- Control access: Decide which workspaces can use which credentials
- Control models: Enable or disable specific models at the Integration level
- Set limits: Different budgets and rate limits per workspace
- Store credentials here (creates an Integration)
- Choose which models are available (enable/disable models)
- Share with workspaces (they see it as a Provider in their Model Catalog)
- Each workspace can use the same credentials with different limits, but only access models you’ve enabled
- Who can use these credentials (which workspaces)
- What models they can access
- How much they can spend (budget limits)
- How fast they can make requests (rate limits)
Why Use Integrations?
Instead of each workspace entering the same API keys separately, store them once and share them:- Save time - No need to re-enter credentials in each workspace
- Control access - Decide which workspaces can use which credentials
- Set limits - Different budgets and rate limits per workspace
- Stay secure - API keys are encrypted and never exposed to end users
- Track everything - See usage and costs across all workspaces
Understanding the Integrations Dashboard
Navigate to the Integrations page in your Prisma AIRS AI Gateway organisation settings. The page is organized into three tabs, each serving a distinct purpose:All: This is a comprehensive list of all 50+ providers the AI Gateway supports. This is your starting point for connecting a new provider to your organisation.Connected: This tab lists all the integrations that you have personally connected at the organisation level. It’s your primary view for managing your centrally-governed providers.Workspace-Created: This tab gives you complete visibility and governance over any integrations created by Workspace Admins for their specific workspaces. It ensures that even with delegated control, you maintain a full audit trail and can manage these instances if needed.
Creating an Integration
Let’s walk through creating an Integration for AWS Bedrock as an example:1
Navigate to Integrations
From your admin panel, go to Integrations and click Create New Integration (or click Connect from the
All tab).2
Select Your AI Provider
Choose from 200+ supported providers. Each provider may have different credential requirements.
3
Configure Integration Details
- Name: A descriptive name for this integration (e.g., “Bedrock Production”)
- Slug: A unique identifier used in API calls (e.g., “bedrock-prod”)
- Description: Optional context about this integration’s purpose
- Endpoint Type: Choose between Public or Private endpoints
4
Enter Provider Credentials
Each provider requires different credentials:For OpenAI:Similarly for:
- API Key
- Optional: Organisation ID, Project ID
- AWS Access Key
- AWS Secret Access Key
- AWS Access Key ID
- AWS Region
Connect Bedrock with Amazon Assumed Role
How to integrate Bedrock using Amazon Assumed Role Authentication
- Azure OpenAI
- Google Vertex AI
- Anthropic
- Gemini and more…
Configuring Your Integration Access & Limits
After creating your Integration, you’ll need to configure three key aspects that work together to control access and usage:Workspace Provisioning
Which teams and projects can use these credentials
Model Provisioning
Which models the Integration exposes, plus custom models and pricing
Budget Limits
Financial guardrails, per workspace, cascading to every provider
Rate Limits
Velocity controls, per workspace, by request or token
Monitoring and Analytics
Tracking Spending and Usage
Track spending, usage, and 40+ crucial metrics for any specific AI integration by navigating to the Analytics tab and filtering by the desired key and timeframe.FAQs
How are provider API keys stored?
How are provider API keys stored?
Your API keys are always encrypted and stored in secure, isolated vaults. They are only decrypted in-memory, within sandboxed workers, at the exact moment a request is made to the provider. This ensures the highest level of security for your credentials.

