Switching Wally to a Bring Your Own (BYO) endpoint

Open Settings → Wally model at /settings/wally. Only org owners and admins can change this setting; members see a read-only view.

To activate BYO:

1. Pick a preset — the page shows cards for Bedrock GovCloud, Bedrock (commercial), Vertex AI EU, Vertex AI US, "Custom Anthropic-compatible endpoint," and "OpenAI-compatible endpoint." Each card lists its compliance badges and a hint for the endpoint URL format.

2. Choose the wire protocol your endpoint speaks:
• **Anthropic** (default) — the endpoint accepts Anthropic Messages API requests. Bedrock, Vertex AI, Anthropic Direct, and most managed gateways fall here.
• **OpenAI Chat Completions** — pick this for endpoints that speak the OpenAI protocol: vLLM, Red Hat AI Inference Server, OpenAI Direct, Azure OpenAI, a self-hosted Llama gateway, or any "OpenAI-compatible" managed service. Turtini translates Wally's Anthropic calls into OpenAI format and bridges the streaming response back — your endpoint sees standard OpenAI traffic, Wally sees standard Anthropic traffic.

3. Paste your endpoint URL — must be https. Examples:
• Bedrock GovCloud: https://bedrock-runtime.us-gov-west-1.amazonaws.com/anthropic/v1/messages
• Vertex EU: https://europe-west4-aiplatform.googleapis.com/v1/projects/YOUR_PROJECT/locations/europe-west4/publishers/anthropic/models/claude-haiku-4-5:streamRawPredict
• A custom Anthropic-compatible gateway: your endpoint that speaks the Anthropic Messages API
• A vLLM/Red Hat AI Inference Server: https://your-vllm-host/v1/chat/completions
• An Azure OpenAI deployment: https://YOUR-RESOURCE.openai.azure.com/openai/deployments/YOUR-DEPLOYMENT/chat/completions?api-version=2024-08-01-preview

4. (Optional) Set a model id override — defaults to claude-haiku-4-5 on the Anthropic path. On the OpenAI path, set it to the model id your endpoint expects (e.g. "claude-haiku-4-5" through an Anthropic-fronted gateway, "gpt-4o-mini" on OpenAI Direct, "meta-llama/Meta-Llama-3.1-70B-Instruct" on vLLM, your deployment name on Azure).

4. (Optional) Set a region label — informational only, surfaced in the audit log and Trust Score breakdown.

5. Paste your API key — this is the part most platforms get wrong. Turtini stores your key in Google Secret Manager, keyed off your org id (wally-byo-key__{orgId}). It NEVER touches Firestore. Disable-not-delete on disconnect, so the audit trail survives even after you switch back.

6. Click "Activate."

7. Run "Test connection" — fires a minimal ping against the resolved endpoint with a 16-token message. Pass/fail is recorded on the org doc with the timestamp.

To rotate the key without changing the endpoint:
Paste a new key in the API key field and re-save. The endpoint config is unchanged; Secret Manager versions the key automatically and the latest version is read on every Wally call.

To disconnect entirely:
Click "Disconnect & return to Turtini-hosted." The Secret Manager key is disabled (kept for audit) and your org doc's wallyModel config is cleared. Wally is back on the Turtini-hosted pool immediately.

Every change writes an entry to the platform audit log with the actor, the new preset, the endpoint URL, and a timestamp.