OpenAI

An OpenAI connection sends OpenAI models to the OpenAI API with your own credential, so OpenAI bills your organization for inference instead of Amp. Enterprise pricing can still add an Amp fee.

The connection authenticates with an API key by default. It can instead use workload identity federation, so Amp stores no key or secret. Both are the same kind of connection, with the same models and settings.

Set Up a Connection

Create an API key in the OpenAI Platform. Then open personal model routing or workspace model routing, add an OpenAI connection, paste the key, and save.

Use the Check Access button to confirm that OpenAI accepts the key.

You can also add the connection from the CLI, with the key in OPENAI_API_KEY:

amp config model-providers add-key openai --workspace

Workload Identity Federation

With workload identity federation, Amp acts as a service account in one of your OpenAI API projects. You create a workload identity provider for Amp under Settings > Organization > Security in the OpenAI Platform and add a service account mapping that admits only tokens for your Amp workspace or user. Amp stores only the IDs of that trust. Before it sends requests, Amp signs a short-lived token and exchanges it with OpenAI for a short-lived access token.

In the connection form, choose Workload Identity Federation as the authentication method. The form shows these steps with your own issuer and subject:

Sign in to see your own AMP_ISSUER and AMP_SUBJECT values.
  1. In the OpenAI Platform, open Settings > Organization > Security > Workload Identity Provider and choose Create identity provider. OpenAI workload identity providers
  2. Name it Amp, keep the Provider type OIDC, set the OIDC Issuer URL to AMP_ISSUER and the Audience to https://api.openai.com/v1 , and leave the Advanced options off. Then choose Create.
  3. Back on Workload Identity Provider, click the provider’s name to open it (Edit provider only changes its settings), then choose Create mapping. Set the Name to amp-model-routing , the Key to sub, the Value to AMP_SUBJECT , and the Description to Amp model routing requests .
  4. Select the Project Amp should bill. Keep Create a new service account in this project checked and name it amp-model-routing . Under Permissions, choose Restricted, set List models to Read and Model capabilities to Request, leave everything else at None, then choose Create.
  5. Copy the identity provider ID (idp_…) from the provider’s page. For the service account ID, open Settings > Organization > People > Members, click the service account’s name, and copy its ID (user-…). OpenAI organization members
  6. Enter the identity provider ID and service account ID in Amp with Workload Identity Federation selected as the authentication method, then save and run Check Access.

The mapping’s permissions limit what Amp can do as the service account. Model requests need Model capabilities set to Request, and Check Access needs List models set to Read.

From the CLI, print the same steps with amp config model-providers setup-guide openai --workspace, then add the connection:

amp config model-providers add-key openai --workspace \
  --openai-identity-provider-id idp_… \
  --openai-service-account-id user-…

To switch an existing connection between an API key and workload identity federation, edit it and choose the other authentication method. The connection keeps its ID, its model settings, and its place in the connection order.

For more, see OpenAI’s documentation on workload identity federation.