Available on the Enterprise plan.
Supported providers
Configuration
Step 1: Add a model
Before assigning a BYOM model to an agent, you need to register it in the admin panel:- Navigate to Admin > Models
- Click Add Model
- Provide a name for the model
- Select the model type (LLM or Embedding)
- Choose a provider and model
- Enter the required credentials for the provider
Step 2: Assign the model to an agent
Once a model is registered, reference it in the agents YAML configuration by name or ID:Network configuration
When using BYOM, Cube connects to your model provider from its control plane. If your provider requires IP allowlisting, ensure the Cube outbound IP addresses are added to your allowlist. For agents running in dedicated regions, additional per-region IP addresses may also need to be allowlisted.Billing
When using a BYOM model, Cube AI tokens are not consumed. You are billed directly by your model provider based on their pricing. This means:- No Cube token quota is deducted for BYOM chat requests
- No token usage is tracked in the AI Tokens Usage dashboard for BYOM requests
- Per-seat token grants and token packages do not apply
Provider-specific notes
Anthropic
Supports extended thinking mode for compatible models. Configure this in the model settings when creating the model.AWS Bedrock
- Credentials are optional — if left empty, the default AWS credential chain is used (e.g., workload identity)
- Supports assume-role configuration for cross-account access
- Supports inference profiles
GCP Vertex AI
Requires a service account JSON key for authentication.Databricks
Requires a workspace URL and access token.Snowflake Cortex
Supports two authentication methods:- JWT authentication
- Key-pair authentication (requires an encrypted PKCS#8 PEM private key)
Custom OpenAI-compatible
Points an agent at any endpoint that implements the OpenAI chat completions API — for example, an internal LLM gateway.- Model and base URL are free text; the base URL must use
httporhttpsand may not target a loopback or link-local host - API key is optional — leave it blank if your endpoint authenticates requests some other way, such as a custom header
- You can add custom HTTP headers sent with every request. Header values may
include placeholders resolved per request from the caller’s identity:
{{userId}},{{userExternalId}},{{email}},{{username}},{{tenantId}},{{tenantName}},{{tenantUrl}},{{deploymentId}}, and{{agentId}}. A placeholder with no value for a request —{{userExternalId}}for a user who did not arrive through signed embedding, for example — is sent through as literal text