coder · ibetitsmike · May 16, 2026 · May 16, 2026 · May 16, 2026 · May 16, 2026
diff --git a/coderd/coderd.go b/coderd/coderd.go
@@ -1250,6 +1250,20 @@ func New(options *Options) *API {
 					r.Delete("/", api.deleteChatProvider)
 				})
 			})
+			r.Route("/ai-providers", func(r chi.Router) {
+				r.Get("/", api.listAIProviders)
+				r.Post("/", api.createAIProvider)
+				r.Route("/{aiProvider}", func(r chi.Router) {
+					r.Get("/", api.readAIProvider)
+					r.Patch("/", api.updateAIProvider)
+					r.Delete("/", api.deleteAIProvider)
+					r.Route("/keys", func(r chi.Router) {
+						r.Get("/", api.listAIProviderKeys)
+						r.Post("/", api.createAIProviderKey)
+						r.Delete("/{aiProviderKey}", api.deleteAIProviderKey)
+					})
+				})
+			})
 			// TODO(cian): place under /api/experimental/chats/config
 			r.Route("/model-configs", func(r chi.Router) {
 				r.Get("/", api.listChatModelConfigs)
@@ -1279,6 +1293,13 @@ func New(options *Options) *API {
 					r.Delete("/", api.deleteUserChatProviderKey)
 				})
 			})
+			r.Route("/user-ai-provider-keys", func(r chi.Router) {
+				r.Get("/", api.listUserAIProviderKeyConfigs)
+				r.Route("/{aiProvider}", func(r chi.Router) {
+					r.Put("/", api.upsertUserAIProviderKey)
+					r.Delete("/", api.deleteUserAIProviderKey)
+				})
+			})
 			r.Route("/{chat}", func(r chi.Router) {
 				r.Use(httpmw.ExtractChatParam(options.Database))
 				r.Get("/", api.getChat)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -2532,6 +2532,13 @@ func (q *querier) GetAIProviderByID(ctx context.Context, id uuid.UUID) (database
 	return q.db.GetAIProviderByID(ctx, id)
 }
 
+func (q *querier) GetAIProviderByIDForUpdate(ctx context.Context, id uuid.UUID) (database.AIProvider, error) {
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceAIProvider); err != nil {
+		return database.AIProvider{}, err
+	}
+	return q.db.GetAIProviderByIDForUpdate(ctx, id)
+}
+
 func (q *querier) GetAIProviderByName(ctx context.Context, name string) (database.AIProvider, error) {
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAIProvider); err != nil {
 		return database.AIProvider{}, err

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -6277,6 +6277,11 @@ func (s *MethodTestSuite) TestAIBridge() {
 		dbm.EXPECT().GetAIProviderByID(gomock.Any(), provider.ID).Return(provider, nil).AnyTimes()
 		check.Args(provider.ID).Asserts(rbac.ResourceAIProvider, policy.ActionRead).Returns(provider)
 	}))
+	s.Run("GetAIProviderByIDForUpdate", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		provider := testutil.Fake(s.T(), faker, database.AIProvider{})
+		dbm.EXPECT().GetAIProviderByIDForUpdate(gomock.Any(), provider.ID).Return(provider, nil).AnyTimes()
+		check.Args(provider.ID).Asserts(rbac.ResourceAIProvider, policy.ActionUpdate).Returns(provider)
+	}))
 	s.Run("GetAIProviderByName", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		provider := testutil.Fake(s.T(), faker, database.AIProvider{})
 		dbm.EXPECT().GetAIProviderByName(gomock.Any(), provider.Name).Return(provider, nil).AnyTimes()
@@ -6305,6 +6310,7 @@ func (s *MethodTestSuite) TestAIBridge() {
 		provider := testutil.Fake(s.T(), faker, database.AIProvider{})
 		arg := database.UpdateAIProviderParams{
 			ID:      provider.ID,
+			Name:    provider.Name,
 			Enabled: true,
 			BaseUrl: "https://api.example.com/",
 		}

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/ai_providers.sql b/coderd/database/queries/ai_providers.sql
@@ -6,6 +6,15 @@ FROM
 WHERE
     id = @id::uuid AND deleted = FALSE;
 
+-- name: GetAIProviderByIDForUpdate :one
+SELECT
+    *
+FROM
+    ai_providers
+WHERE
+    id = @id::uuid AND deleted = FALSE
+FOR UPDATE;
+
 -- name: GetAIProviderByName :one
 SELECT
     *
@@ -54,6 +63,7 @@ RETURNING
 UPDATE
     ai_providers
 SET
+    name = @name::text,
     display_name = sqlc.narg('display_name')::text,
     enabled = @enabled::boolean,
     base_url = @base_url::text,

diff --git a/coderd/database/queries/chatmodelconfigs.sql b/coderd/database/queries/chatmodelconfigs.sql
@@ -34,12 +34,17 @@ SELECT
     cmc.*
 FROM
     chat_model_configs cmc
-JOIN
+LEFT JOIN
+    ai_providers ap ON ap.id = cmc.ai_provider_id AND ap.deleted = FALSE
+LEFT JOIN
     chat_providers cp ON cp.provider = cmc.provider
 WHERE
     cmc.enabled = TRUE
     AND cmc.deleted = FALSE
-    AND cp.enabled = TRUE
+    AND (
+        (cmc.ai_provider_id IS NOT NULL AND ap.enabled = TRUE)
+        OR (cmc.ai_provider_id IS NULL AND cp.enabled = TRUE)
+    )
 ORDER BY
     cmc.provider ASC,
     cmc.model ASC,
@@ -53,13 +58,18 @@ FROM
     chat_model_configs cmc
 -- Providers can be disabled independently of their model configs.
 -- Check both to ensure the selected config is actually usable.
-JOIN
+LEFT JOIN
+    ai_providers ap ON ap.id = cmc.ai_provider_id AND ap.deleted = FALSE
+LEFT JOIN
     chat_providers cp ON cp.provider = cmc.provider
 WHERE
     cmc.id = @id::uuid
     AND cmc.deleted = FALSE
     AND cmc.enabled = TRUE
-    AND cp.enabled = TRUE;
+    AND (
+        (cmc.ai_provider_id IS NOT NULL AND ap.enabled = TRUE)
+        OR (cmc.ai_provider_id IS NULL AND cp.enabled = TRUE)
+    );
 
 -- name: InsertChatModelConfig :one
 INSERT INTO chat_model_configs (