AI Providers

Overview

AIGCS supports 16 built-in AI providers plus any OpenAI-compatible custom provider. Provider API keys are encrypted at rest at the site level using AES-256-GCM.

Global & Site-level Providers

AIGCS adopts a Global Control + Site Independent Configuration architecture:

Global AI Providers Management (/providers): Features a single "Enable / Disable" toggle switch for each provider (disabled by default). Global providers determine whether the AI option is enabled across sites.
Site AI Providers Management: Configure individual API keys, model names, endpoints, custom avatars, model display names, and sorting weights per site. Sites inherit global enable states automatically.

Multiple Model Configurations Per Provider

AIGCS supports adding multiple model configurations for the same AI provider within the same site.

For example, you can configure two separate AI model roles for OpenAI:

Display Name: OpenAI (GPT-5.5), Model: gpt-5.5
Display Name: OpenAI (GPT-5.6-sol), Model: gpt-5.6-sol

Rules & Notes:

Display Name: Each provider model configuration must have a unique Display Name per site to distinguish roles.
Frontend Widget Rendering: Once saved, the embedded comment widget renders all enabled AI model roles simultaneously and independently.

Built-in Providers

Native & Multi-Protocol Providers

OpenAI

Field	Value
Type Key	`openai`
Auth	Bearer Token (API Key)
Default Model	`gpt-5.5`
Endpoint	`https://api.openai.com/v1`

{
  "type": "openai",
  "apiKey": "sk-...",
  "model": "gpt-5.5",
  "enabled": true
}

Google Gemini

Field	Value
Type Key	`gemini`
Auth	API Key (URL query param `?key=`)
Default Model	`gemini-3.6-flash`
Endpoint	`https://generativelanguage.googleapis.com/v1beta`
Protocol Modes	Supports 3 formats: `interactions` (Interactions API default), `generateContent` (Classic Native), `openai` (OpenAI Proxy)

Anthropic Claude

Field	Value
Type Key	`claude`
Auth	`x-api-key` header
Default Model	`claude-sonnet-5`
Endpoint	`https://api.anthropic.com/v1`
Protocol Modes	Supports 2 formats: `messages` (Anthropic Messages API default), `openai` (OpenAI Proxy)

OpenAI-Compatible Providers

These providers use the OpenAI-compatible API format — configure with the same settings, just change the endpoint and model name.

Provider	Type Key	Default Model	Endpoint
Grok (xAI)	`grok`	`grok-4.5`	`https://api.x.ai/v1`
DeepSeek	`deepseek`	`deepseek-v4-flash`	`https://api.deepseek.com`
Xiaomi MiMo	`xiaomi`	`mimo-v2.5`	`https://api.xiaomimimo.com/v1`
Doubao	`doubao`	`doubao-seed-2.1-pro`	`https://ark.cn-beijing.volces.com/api/v3`
Hunyuan	`hunyuan`	`hy3`	`https://api.hunyuan.cloud.tencent.com/v1`
Qwen (千问)	`qwen`	`qwen3.7-max`	`https://dashscope.aliyuncs.com/compatible-mode/v1`
GLM (智谱)	`glm`	`glm-5.2`	`https://open.bigmodel.cn/api/paas/v4`
MiniMax	`minimax`	`minimax-m3`	`https://api.minimax.ai/v1`
Kimi (月之暗面)	`kimi`	`kimi-k3`	`https://api.moonshot.cn/v1`
Baidu Wenxin	`wenxin`	`ernie-5.1`	`https://qianfan.baidubce.com/v2`
iFlytek Spark	`spark`	`spark-x2`	`https://spark-api-open.xf-yun.com/v1`
Meituan LongCat	`longcat`	`LongCat-2.0`	`https://api.longcat.meituan.com/v1`

Local Providers

Ollama

Field	Value
Type Key	`ollama`
Auth	None
Default Model	`llama3`
Endpoint	`http://localhost:11434/v1`

Custom Provider

Any unknown type key creates an OpenAI-compatible provider dynamically:

{
  "type": "custom-provider-name",
  "apiKey": "sk-...",
  "endpoint": "https://your-custom-endpoint/v1",
  "model": "your-model",
  "enabled": true
}

Custom Provider Avatars

AIGCS supports 3 methods to configure custom AI provider avatars:

Paste Code: Paste raw inline <svg> vector code directly;
CDN URL Reference: Enter external image CDN URLs (not limited to SVG, supports PNG/JPG/WebP/GIF, etc.);
Upload Image: Upload local image files stored directly in AIGCS media storage (not limited to SVG).

Configured avatars are automatically synchronized and rendered in admin comment lists, preview modals, and the frontend widget.

After configuring a provider, click Test to run a sample connectivity test. Test results remain persistently visible (no auto-closing timer) to allow thorough inspection until manually dismissed via the ✕ button.

API Key Security

API keys follow this security flow:

User input → AES-256-GCM encrypt → Store in database
    ↓
Generation time → Decrypt in memory → Send to API → Discard

The encryption key is derived from ENCRYPTION_KEY (or falls back to JWT_SECRET).