diff --git a/src/content/docs/agent-platform/inference/bring-your-own-api-key.mdx b/src/content/docs/agent-platform/inference/bring-your-own-api-key.mdx index 81cff0a3c..e68f93f3f 100644 --- a/src/content/docs/agent-platform/inference/bring-your-own-api-key.mdx +++ b/src/content/docs/agent-platform/inference/bring-your-own-api-key.mdx @@ -28,7 +28,7 @@ Warp offers several ways to bring your own AI infrastructure. Use this table to | --- | --- | --- | | **Bring Your Own API Key** (BYOK) | Use your own API key for OpenAI, Anthropic, or Google models. Keys are stored locally on your device. | Free and all eligible paid plans | | **[Custom inference endpoint](/agent-platform/inference/custom-inference-endpoint/)** | Connect Warp to an OpenAI-compatible endpoint such as OpenRouter, LiteLLM, z.ai, or an internal gateway. | Free and all eligible paid plans | -| **[Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/)** (BYOLLM) | Enterprise-managed inference through your cloud provider (AWS Bedrock today; Azure Foundry and Google Vertex coming soon), with Warp handling routing, orchestration, governance, and observability. | Enterprise only | +| **[Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/)** (BYOLLM) | Enterprise-managed inference through your cloud provider (AWS Bedrock and Gemini Enterprise on Vertex AI today; Azure Foundry coming soon), with Warp handling routing, orchestration, governance, and observability. | Enterprise only | | **[SuperGrok subscription](/agent-platform/inference/grok-subscription/)** | Connect your SuperGrok subscription to use Grok models through your xAI account. Tokens are stored locally on your device. | Free and all eligible paid plans | See [Warp pricing](https://www.warp.dev/pricing) for current plan availability. diff --git a/src/content/docs/agent-platform/inference/custom-inference-endpoint.mdx b/src/content/docs/agent-platform/inference/custom-inference-endpoint.mdx index 1f89f426a..184d5f614 100644 --- a/src/content/docs/agent-platform/inference/custom-inference-endpoint.mdx +++ b/src/content/docs/agent-platform/inference/custom-inference-endpoint.mdx @@ -119,7 +119,7 @@ Warp itself never stores your endpoint API key. Review your endpoint provider's The custom inference endpoints described on this page are configured at the **user level** on every plan. Each user adds their own endpoint locally, and it works only for interactive requests, not [cloud agents](/platform/). -Enterprise teams can also configure **team-managed custom endpoints** centrally: an admin sets shared endpoints in the [Admin Panel](/enterprise/team-management/admin-panel/), and they work for both interactive requests and cloud agents. See [Team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/), or [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) for AWS Bedrock routing. +Enterprise teams can also configure **team-managed custom endpoints** centrally: an admin sets shared endpoints in the [Admin Panel](/enterprise/team-management/admin-panel/), and they work for both interactive requests and cloud agents. See [Team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/), or [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) for AWS Bedrock or Gemini Enterprise (Vertex AI) routing. ## How custom inference endpoints differ from BYOK and BYOLLM @@ -129,7 +129,7 @@ Warp offers three ways to bring your own AI infrastructure. Use this table to pi | --- | --- | --- | | **[Bring Your Own API Key](/agent-platform/inference/bring-your-own-api-key/)** (BYOK) | Use your own API key for OpenAI, Anthropic, or Google models. Keys are stored locally on your device. | Free and all eligible paid plans | | **Custom inference endpoint** | Connect Warp to an OpenAI-compatible endpoint such as OpenRouter, LiteLLM, z.ai, or an internal gateway. | Free and all eligible paid plans | -| **[Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/)** (BYOLLM) | Enterprise-managed inference through your cloud provider (AWS Bedrock today; Azure Foundry and Google Vertex coming soon), with Warp handling routing, orchestration, governance, and observability. | Enterprise only | +| **[Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/)** (BYOLLM) | Enterprise-managed inference through your cloud provider (AWS Bedrock and Gemini Enterprise on Vertex AI today; Azure Foundry coming soon), with Warp handling routing, orchestration, governance, and observability. | Enterprise only | Platform credits may apply for local agent runs on Business and Enterprise when using BYOK, a custom inference endpoint, or BYOLLM. See [platform credits](/support-and-community/plans-and-billing/platform-credits/). diff --git a/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx b/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx index 3d8112453..4406202ec 100644 --- a/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx +++ b/src/content/docs/enterprise/enterprise-features/bring-your-own-llm.mdx @@ -1,16 +1,21 @@ --- title: Bring Your Own LLM description: >- - Route Warp's agents through your AWS Bedrock models for billing control and - infrastructure flexibility. + Route Warp's agents through your own AWS Bedrock or Google Cloud (Gemini + Enterprise) models for billing control and infrastructure flexibility. --- -Warp supports **Bring Your Own LLM (BYOLLM)** for enterprise teams that need to run inference on their own cloud infrastructure. With BYOLLM, your team can use Warp's agents while routing inference through models hosted in your AWS Bedrock environment. +Warp supports **Bring Your Own LLM (BYOLLM)** for enterprise teams that need to run inference on their own cloud infrastructure. With BYOLLM, your team can use Warp's agents while routing inference through models hosted in your AWS Bedrock environment or your Google Cloud project. This gives you control over cloud spend and model hosting, without changing how your team works in Warp. +## Supported providers + +* **AWS Bedrock** - Route inference through models hosted in your AWS account. Interactive requests use each member's AWS CLI session credentials, and cloud agent runs assume an IAM role via OIDC. Setup is covered on this page. +* **Gemini Enterprise (Vertex AI)** - Route inference through your Google Cloud project using short-lived Workload Identity Federation credentials. See [BYOLLM: Gemini Enterprise](/enterprise/enterprise-features/byollm-gemini-enterprise/) for setup. + :::caution -BYOLLM currently supports **AWS Bedrock** only. Coming soon: Azure Foundry and Google Vertex support. +Azure Foundry support is coming soon. The rest of this page covers the AWS Bedrock configuration. ::: :::note @@ -58,7 +63,7 @@ This approach ensures access management stays with your cloud provider, giving a ### Model availability -BYOLLM supports the intersection of models that Warp supports and models available on AWS Bedrock. Currently, only **Claude models** (Anthropic) are available through AWS Bedrock. OpenAI and Google models are not available on Bedrock. +BYOLLM supports the intersection of models that Warp supports and models available on your provider. On AWS Bedrock, only **Claude models** (Anthropic) are available; OpenAI and Google models are not available on Bedrock. To route Gemini models (or Claude partner models on Vertex AI) through your Google Cloud project, use [Gemini Enterprise BYOLLM](/enterprise/enterprise-features/byollm-gemini-enterprise/) instead. To determine which models you can use with BYOLLM: @@ -338,7 +343,7 @@ However, when using BYOLLM: **BYOK (Bring Your Own API Key)** lets individual users add their own API keys for direct model provider access (e.g., Anthropic, OpenAI, Google). Warp stores keys locally on the user's device. -**BYOLLM (Bring Your Own LLM)** routes inference through your organization's cloud infrastructure (AWS Bedrock) using cloud-native IAM. Admins configure it at the admin level and it applies to the entire team. +**BYOLLM (Bring Your Own LLM)** routes inference through your organization's cloud infrastructure (AWS Bedrock or Google Cloud via Gemini Enterprise) using cloud-native IAM. Admins configure it at the admin level and it applies to the entire team. Enterprise admins can also centrally manage BYOK itself: [team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) let an admin configure shared provider keys and OpenAI-compatible endpoints that are stored server-side and work for both interactive requests and cloud agents. The table below compares BYOLLM with the self-serve, user-level form of BYOK. For a side-by-side comparison that also includes team-managed keys and endpoints, see [How team-managed providers differ from self-serve BYOK and BYOLLM](/enterprise/enterprise-features/team-managed-keys-and-endpoints/#how-team-managed-providers-differ-from-self-serve-byok-and-byollm). @@ -372,6 +377,7 @@ Yes. Admins can configure routing policies to require specific models to use BYO ## Related resources +* [BYOLLM: Gemini Enterprise (Vertex AI)](/enterprise/enterprise-features/byollm-gemini-enterprise/) — Route inference through your Google Cloud project * [Bring Your Own API Key](/agent-platform/inference/bring-your-own-api-key/) * [Team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) — Enterprise admins configure shared provider keys and custom endpoints for the team * [Model Choice](/agent-platform/inference/model-choice/) — Full list of supported models diff --git a/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx b/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx new file mode 100644 index 000000000..c31dac2af --- /dev/null +++ b/src/content/docs/enterprise/enterprise-features/byollm-gemini-enterprise.mdx @@ -0,0 +1,284 @@ +--- +title: "BYOLLM: Gemini Enterprise (Vertex AI)" +sidebar: + label: "BYOLLM: Gemini Enterprise" +description: >- + Route Warp Agent inference through your own Google Cloud project with Gemini + Enterprise BYOLLM. Short-lived Workload Identity Federation credentials, + admin-controlled models, and inference billed to your GCP account. +--- + +Warp's **Gemini Enterprise** BYOLLM integration routes agent inference through your own Google Cloud project using **Vertex AI** (the Gemini Enterprise Agent Platform). Your team keeps using Warp's agents as usual, while eligible requests execute against models hosted in your GCP project, billed to your Google Cloud account and governed by your IAM controls. + +Gemini Enterprise is one of the providers supported by [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/). For AWS-based routing, see the [AWS Bedrock BYOLLM setup](/enterprise/enterprise-features/bring-your-own-llm/). + +:::note +Gemini Enterprise BYOLLM is only available on Warp's Enterprise plan and requires Warp `v0.2026.06.17` or later. [Contact sales](https://www.warp.dev/contact-sales) to learn more. +::: + +:::caution +Gemini Enterprise BYOLLM currently applies to **interactive agent requests** in the Warp app. [Cloud agent](/platform/) runs don't route through Gemini Enterprise yet; cloud agent support is available today with [AWS Bedrock BYOLLM](/enterprise/enterprise-features/bring-your-own-llm/#enabling-byollm-for-cloud-agents). +::: + +## Key features + +* **No local Google credentials required** - Members don't run `gcloud auth`, manage Application Default Credentials, or paste API keys. Warp mints a short-lived Google Cloud access token through Workload Identity Federation (WIF), rooted in each member's signed-in Warp session. +* **Admin-controlled routing and models** - Admins configure the GCP project, Vertex location, and WIF provider once in the Admin Panel, then choose exactly which models are enabled and which Vertex model references they resolve to. +* **Gemini and Claude models** - Route native Gemini models and Claude partner models available on Vertex AI through your project. +* **Consolidated billing and quota attribution** - Inference runs against your project's Vertex AI quota and is billed to your Google Cloud account. Requests carry your project for quota attribution (`X-Goog-User-Project`). +* **No stored credentials** - Warp never stores long-lived Google credentials. Each request carries only a short-lived access token that Warp uses in memory and discards when the request ends. + +## How it works + +When Gemini Enterprise is enabled, Warp redirects eligible inference calls to Vertex AI in your Google Cloud project instead of using model providers' direct APIs. + +Here's the high-level flow: + +1. **Admin configures routing** - Your team admin enables the Gemini Enterprise host on the **Models** page of the [Admin Panel](/enterprise/team-management/admin-panel/) and sets the GCP project, Vertex location, and WIF provider. +2. **Members enable credentials** - Each signed-in member turns on **Use Gemini Enterprise credentials** in Warp's Settings (or the admin enforces it team-wide). +3. **Warp mints a short-lived token** - The Warp client exchanges a Warp-signed identity token for a short-lived Google Cloud access token via Google's Security Token Service (STS), optionally impersonating a service account you designate. +4. **Warp routes requests** - Eligible agent requests carry that access token, and Warp's backend uses it to call Vertex AI in your project with the configured location and model reference. +5. **Inference executes in your cloud** - The model runs in your GCP project. Responses stream back to the Warp client. + +### Credential lifecycle + +Gemini Enterprise uses **federated, short-lived credentials** instead of API keys or local cloud CLI sessions: + +* **Rooted in the Warp session** - Each mint starts from the member's signed-in Warp session. Warp issues a signed OpenID Connect (OIDC) token, exchanges it at Google STS for a federated access token, and, if configured, impersonates your designated service account. +* **Automatic refresh** - Tokens are held in memory and refreshed automatically about five minutes before they expire. Members don't need to re-authenticate during normal use. +* **Strict binding** - A minted token is only attached to requests while the signed-in user and the admin's WIF configuration still match. Signing out, switching accounts, or admin configuration changes invalidate it. +* **No storage or logging** - The client never uploads refresh tokens, credential JSON, or service account keys, and Warp's servers never persist or log the access token. + +### Model availability + +Gemini Enterprise supports the intersection of models that Warp supports and models available through Vertex AI in your project: + +* **Native Gemini models** - Current Gemini Flash, Flash Lite, and Pro families (for example, Gemini 3.1 Pro and Gemini 3.6 Flash). +* **Claude partner models on Vertex AI** - Current Claude Sonnet, Opus, Haiku, and Fable families offered as Vertex AI partner models. + +In the Warp app's model picker, eligible models show a Gemini Enterprise badge when your credentials are active. Models absent from the registry (including extended-thinking and fast-mode variants, and Fireworks-hosted models like Kimi, MiniMax, Qwen, DeepSeek, and GLM) aren't available through Gemini Enterprise. Some models are disabled by default for Enterprise teams and require explicit admin enablement. + +To determine which models you can use, see [Model Choice](/agent-platform/inference/model-choice/) for Warp's supported models and the **Models** page of the Admin Panel for your team's Gemini Enterprise enablement. + +## Enabling Gemini Enterprise + +Setup has two halves: a one-time Google Cloud configuration (WIF trust and IAM), then routing configuration in Warp's Admin Panel. + +### Prerequisites + +* **Warp Enterprise plan with admin access** - You configure routing on the **Models** page of the [Admin Panel](/enterprise/team-management/admin-panel/). +* **A Google Cloud project with Vertex AI enabled** - Enable the Vertex AI API (`aiplatform.googleapis.com`) in the project that should own inference, quota, and billing. +* **Model access in Vertex AI** - Gemini models are available by default; Claude partner models must be enabled for your project in the Vertex AI Model Garden. +* **GCP IAM admin access** - You need permission to create a Workload Identity Pool, provider, and IAM bindings (and optionally a service account). + +### 1. Create a Workload Identity Federation pool and provider (cloud admin) + +Before Google Cloud can trust tokens issued by Warp, register Warp as an OIDC identity provider in a Workload Identity Pool. This is a one-time setup per GCP project. + +Warp's OIDC tokens use the issuer `https://app.warp.dev` and carry these claims: + +* `sub` - Shaped as `scoped_principal:/:`, where `` is `user` for interactive requests. +* `teams` - The list of Warp team UIDs the user belongs to. Mapping this claim to `google.groups` lets you grant access to your whole Warp team with one IAM binding. + +The `` is the Warp team UID for your team. You can find it in your team's [Admin Panel](/enterprise/team-management/admin-panel/) URL as the path segment after `/admin/`. For example, in `https://app.warp.dev/admin/HzjUdNkg8Uiq8gp6FMgfxe/models`, the team UID is `HzjUdNkg8Uiq8gp6FMgfxe`. + +**Example: create the pool and provider with the gcloud CLI** + +```bash +gcloud iam workload-identity-pools create warp-byollm \ + --project=PROJECT_ID \ + --location=global \ + --display-name="Warp BYOLLM" + +gcloud iam workload-identity-pools providers create-oidc warp \ + --project=PROJECT_ID \ + --location=global \ + --workload-identity-pool=warp-byollm \ + --issuer-uri="https://app.warp.dev" \ + --attribute-mapping="google.subject=assertion.sub,google.groups=assertion.teams" \ + --attribute-condition="'TEAM_UID' in assertion.teams" +``` + +Replace `PROJECT_ID` with your GCP project ID and `TEAM_UID` with your Warp team UID. The attribute condition restricts the provider to tokens from your Warp team. + +After creating the provider, note its full resource name; you'll paste it into Warp as the **WIF audience** in Step 3: + +```text +//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/warp-byollm/providers/warp +``` + +Replace `PROJECT_NUMBER` with your GCP project number. For more detail, see Google's [Workload Identity Federation documentation](https://cloud.google.com/iam/docs/workload-identity-federation). + +### 2. Grant Vertex AI access (cloud admin) + +Grant the federated identities permission to run Vertex AI inference in your project. Use least-privilege IAM bindings scoped to your Warp team's group principal. + +The two required roles are: + +* `roles/aiplatform.user` - Allows Vertex AI inference calls. +* `roles/serviceusage.serviceUsageConsumer` - Allows quota attribution to your project (Warp sends your project as the quota project on each request). + +**Option A: Direct federated access** + +Grant the roles directly to your Warp team's principal set. Leave the service account field empty in Warp. + +```bash +gcloud projects add-iam-policy-binding PROJECT_ID \ + --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/warp-byollm/group/TEAM_UID" \ + --role="roles/aiplatform.user" + +gcloud projects add-iam-policy-binding PROJECT_ID \ + --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/warp-byollm/group/TEAM_UID" \ + --role="roles/serviceusage.serviceUsageConsumer" +``` + +**Option B: Service account impersonation** + +If your organization prefers auditing through a dedicated service account, create one, grant it the two roles above, and allow the federated principal set to impersonate it: + +```bash +gcloud iam service-accounts add-iam-policy-binding \ + warp-byollm@PROJECT_ID.iam.gserviceaccount.com \ + --member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/warp-byollm/group/TEAM_UID" \ + --role="roles/iam.workloadIdentityUser" +``` + +With this option, also enable the IAM Service Account Credentials API (`iamcredentials.googleapis.com`) and enter the service account's email in Warp in Step 3. Warp never receives the service account's keys; the client requests short-lived impersonated tokens at mint time. + +### 3. Configure routing in the Admin Panel (Warp admin) + +Connect Warp to your GCP configuration so eligible requests route to your project: + +1. In the [Admin Panel](https://app.warp.dev/admin/), go to the **Models** page and find the **Gemini Enterprise** host configuration. +2. Enter the **GCP project ID**, choose a **location**, and paste the **WIF audience** (the full provider resource name from Step 1). Optionally enter the **service account email** from Step 2, Option B. +3. Toggle **Gemini Enterprise** on, then enable the models that should route through your project. You can override the Vertex model reference per model; clearing an override restores Warp's default. +4. Optionally, disable **Direct API** access for those models to enforce provider-only routing. + +The default location is `global`. Multi-region values (`global`, `us`, `eu`) and specific regions (for example, `us-central1`) are supported; the location applies host-wide to all Gemini Enterprise models. + +You can also choose how member credentials behave: + +* **Enforce** - Every signed-in member's client uses Gemini Enterprise credentials automatically, and the member toggle is managed by the organization. +* **Respect user setting** - Each member opts in with the **Use Gemini Enterprise credentials** toggle in their Settings. + +### 4. Validate + +Run a test prompt in Warp using a model enabled for Gemini Enterprise. Verify: + +* The model shows the Gemini Enterprise badge in the model picker. +* The request completes successfully. +* The request appears in your project's Vertex AI monitoring or Cloud Logging. + +## Using Gemini Enterprise as a team member + +Members need to be signed in to Warp; the credential flow is rooted in the Warp session, so Gemini Enterprise isn't available to logged-out users. + +1. In the Warp app, go to **Settings** > **Agents** > **Warp Agent** and scroll to the **Gemini Enterprise** section. The section appears once your admin has enabled the host. +2. Toggle **Use Gemini Enterprise credentials** on. If your admin enforces credentials team-wide, the toggle is already on and managed by your organization. +3. Check the credential status card. It shows the current state (for example, loaded with the next scheduled refresh, refreshing, setup incomplete, or a failure) and a **Refresh** button to force a new credential mint. +4. Pick an eligible model in the model picker. Models routed through your project show a Gemini Enterprise badge. + +If the status card reports that setup is incomplete, your workspace's Gemini Enterprise host is enabled but not fully configured; contact your team admin. + +## Routing and fallback behavior + +### Host priority + +For each request, Warp expands the selected model into the hosts your admin has enabled and tries them in a fixed order: + +1. AWS Bedrock +2. Gemini Enterprise +3. Direct API + +The priority is fixed and not admin-configurable. A Gemini Enterprise route is only used when the request carries valid Gemini Enterprise credentials; otherwise Warp falls back to the next enabled host. + +### Failover behavior + +If a Gemini Enterprise request fails (for example, due to IAM misconfiguration or Vertex AI quota limits), Warp attempts to fall back to the next available host your admin has enabled. If a fallback uses a Direct API model, that request consumes Warp credits. If no fallback is available, Warp displays a clear error message. + +### Auto model selection + +Auto model selection is disabled if an admin disables **any** Direct API model, regardless of Gemini Enterprise configuration. When Direct API models remain enabled, Auto picks the best model for the task; if the selected model is enabled for Gemini Enterprise and your credentials are active, the request routes through your project. + +## Billing behavior + +When a request routes through Gemini Enterprise: + +* **Warp doesn't consume AI credits** for that request. Inference is billed by Google Cloud to your project. +* **Platform credits still apply** - On Business and Enterprise plans, local agent runs that use customer-supplied inference consume [platform credits](/support-and-community/plans-and-billing/platform-credits/) for Warp's platform infrastructure. +* **Fallbacks are billed normally** - A request that falls back to a Direct API model consumes Warp credits at the standard rate. + +See [The three credit buckets](/support-and-community/plans-and-billing/platform-credits/#the-three-credit-buckets) for more on credit types. + +## Security and data handling + +### Credential security + +* **No long-lived credentials** - The only long-lived credential involved is the member's Warp session. Access tokens are short-lived, held in memory, and never persisted. +* **Nothing sensitive leaves your boundary** - Warp stores only non-secret routing configuration (project ID, location, WIF audience, and optional service account email). Service account keys, refresh tokens, and credential files are never uploaded to Warp. +* **Per-user identity** - Every token is minted for the individual signed-in member, so access control and revocation stay in your identity stack: remove a member from your Warp team (or restrict the WIF provider's attribute condition) and their tokens stop minting. + +### Zero Data Retention (ZDR) + +Warp maintains **SOC 2 compliance** and has **Zero Data Retention (ZDR)** agreements with its contracted LLM providers. + +However, when using Gemini Enterprise: + +* **Your** Google Cloud project settings determine data retention policies. +* Warp cannot enforce ZDR for requests routed through your infrastructure. +* Review Vertex AI's data governance settings for your project to control retention. + +### Auditability + +* Warp keeps all conversations fully steerable and logged within Warp. +* Your GCP project retains provider-side logs (usage, latency, errors) in Vertex AI monitoring and Cloud Logging, attributed to your project. + +## Troubleshooting + +### Common errors + +* **Credentials expired or invalid** - The request reached Vertex AI but was rejected as unauthenticated. Click **Refresh credentials** in the inline error, or use the **Refresh** button in **Settings** > **Agents** > **Warp Agent**, then retry. +* **Setup incomplete** - The host is enabled but the WIF audience is missing or blank. A team admin needs to complete the **Models** page configuration. +* **Token exchange or impersonation failed** - Verify the WIF provider's issuer (`https://app.warp.dev`), attribute mapping, and attribute condition, and (for Option B) that the principal set holds `roles/iam.workloadIdentityUser` on the service account. +* **Permission denied from Vertex AI** - Confirm the federated principal (or service account) holds `roles/aiplatform.user` and `roles/serviceusage.serviceUsageConsumer` on the project. +* **Model not found** - Confirm the model is available in your configured location and, for Claude partner models, enabled in the Vertex AI Model Garden. Check any per-model reference overrides on the **Models** page. +* **Provider quota limits** - Check your project's Vertex AI quotas and request increases if needed. + +### Debugging steps + +1. Confirm the WIF audience in the Admin Panel exactly matches the provider's full resource name. +2. Check the credential status card in **Settings** > **Agents** > **Warp Agent** for the failing state and recovery action. +3. Verify IAM bindings for the principal set (or service account) in your GCP project. +4. Confirm the model reference and location match what's available in your project. +5. Inspect Cloud Logging in your project for request details and errors. + +## FAQ + +### How is this different from BYOK with a Google API key? + +**BYOK** routes requests to the Gemini Developer API using a personal API key stored on each member's device. **Gemini Enterprise BYOLLM** routes requests to Vertex AI in your organization's GCP project using short-lived federated credentials, configured centrally by an admin, with your project's IAM, quota, and billing. See [Bring Your Own API Key](/agent-platform/inference/bring-your-own-api-key/) for the self-serve option. + +### Do members need the gcloud CLI installed? + +No. Unlike [AWS Bedrock BYOLLM](/enterprise/enterprise-features/bring-your-own-llm/), which uses each member's local AWS CLI session, Gemini Enterprise mints credentials from the member's signed-in Warp session. No local Google tooling or configuration is required. + +### Does Gemini Enterprise work with cloud agents? + +Not yet. Gemini Enterprise currently routes interactive agent requests in the Warp app. Cloud agent BYOLLM is available today through [AWS Bedrock](/enterprise/enterprise-features/bring-your-own-llm/#enabling-byollm-for-cloud-agents), and Gemini Enterprise support for cloud agents is planned. + +### Which Claude models route through my project? + +Claude models offered as Vertex AI partner models (current Sonnet, Opus, Haiku, and Fable families) can route through Gemini Enterprise when your admin enables them. Eligible models show the Gemini Enterprise badge in the model picker. This is unrelated to any routing Warp does through its own infrastructure for Warp-billed requests. + +### Can admins enforce provider-only routing? + +Yes. Admins can disable Direct API access for models on the **Models** page so eligible requests only route through your project. Note that disabling any Direct API model also disables Auto model selection. + +## Related resources + +* [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) - BYOLLM overview and AWS Bedrock setup +* [Team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) - Admin-configured shared provider keys and custom endpoints +* [Bring Your Own API Key](/agent-platform/inference/bring-your-own-api-key/) - Self-serve, user-level API keys +* [Model Choice](/agent-platform/inference/model-choice/) - Full list of supported models +* [Admin Panel](/enterprise/team-management/admin-panel/) - Configure team settings +* [Contact sales](https://www.warp.dev/contact-sales) - Get help with Enterprise setup diff --git a/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx b/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx index e88e723fe..99996ecbf 100644 --- a/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx +++ b/src/content/docs/enterprise/enterprise-features/team-managed-keys-and-endpoints.mdx @@ -34,9 +34,10 @@ Warp offers several ways to bring your own AI infrastructure. Use this table to | **Team-managed API keys and endpoints** | Team admin (Admin Panel) | Server-side by Warp | Yes | Enterprise only | | **[Bring Your Own API Key](/agent-platform/inference/bring-your-own-api-key/)** (BYOK) | Each member | Locally on the member's device | No | Free and all eligible paid plans | | **[Custom inference endpoint](/agent-platform/inference/custom-inference-endpoint/)** | Each member | Locally on the member's device | No | Free and all eligible paid plans | -| **[Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/)** (BYOLLM) | Team admin (Admin Panel) | Cloud-native IAM (no stored keys) | Yes | Enterprise only | +| **[BYOLLM — AWS Bedrock](/enterprise/enterprise-features/bring-your-own-llm/)** | Team admin (Admin Panel) | Cloud-native IAM (no stored keys) | Yes | Enterprise only | +| **[BYOLLM — Gemini Enterprise](/enterprise/enterprise-features/byollm-gemini-enterprise/)** | Team admin (Admin Panel) | Cloud-native IAM (no stored keys) | No (interactive sessions only) | Enterprise only | -Team-managed API keys and endpoints and [BYOLLM](/enterprise/enterprise-features/bring-your-own-llm/) are both Enterprise, admin-configured options. Choose team-managed keys and endpoints to route through provider APIs (OpenAI, Anthropic, Google) or any OpenAI-compatible endpoint using stored keys. Choose BYOLLM to route through your own AWS Bedrock environment using cloud-native IAM instead of long-lived keys. +Team-managed API keys and endpoints and BYOLLM are both Enterprise, admin-configured options. Choose team-managed keys and endpoints to route through provider APIs (OpenAI, Anthropic, Google) or any OpenAI-compatible endpoint using stored keys. Choose [AWS Bedrock BYOLLM](/enterprise/enterprise-features/bring-your-own-llm/) for cloud-native IAM routing through your AWS account, including cloud agent support. Choose [Gemini Enterprise BYOLLM](/enterprise/enterprise-features/byollm-gemini-enterprise/) for cloud-native IAM routing through your Google Cloud project; in this iteration, Gemini Enterprise BYOLLM supports interactive sessions only, with cloud agent support planned. ## How it works @@ -129,7 +130,7 @@ Warp is **SOC 2 compliant** and has **Zero Data Retention (ZDR)** agreements wit * [Bring Your Own API Key](/agent-platform/inference/bring-your-own-api-key/) — Self-serve, user-level API keys for OpenAI, Anthropic, and Google. * [Custom inference endpoint](/agent-platform/inference/custom-inference-endpoint/) — Self-serve, user-level OpenAI-compatible endpoints. -* [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) — Enterprise inference through your AWS Bedrock environment using cloud-native IAM. +* [Bring Your Own LLM](/enterprise/enterprise-features/bring-your-own-llm/) — Enterprise inference through your AWS Bedrock or Google Cloud environment using cloud-native IAM. * [Admin Panel](/enterprise/team-management/admin-panel/) — Configure team settings and model routing. * [Model Choice](/agent-platform/inference/model-choice/) — Full list of supported models. * [Contact sales](https://www.warp.dev/contact-sales) — Get help with Enterprise setup. diff --git a/src/content/docs/enterprise/getting-started/getting-started-enterprise.mdx b/src/content/docs/enterprise/getting-started/getting-started-enterprise.mdx index e3a1fb976..d8f85c5d4 100644 --- a/src/content/docs/enterprise/getting-started/getting-started-enterprise.mdx +++ b/src/content/docs/enterprise/getting-started/getting-started-enterprise.mdx @@ -111,7 +111,7 @@ Alternatively, visit the [Warp Admin Panel](https://app.warp.dev/admin) directly * **Billing** - View your plan type and AI usage limit information * **Teams** - Manage team members, roles, and invites — the same controls available in **Settings** > **Teams** in the Warp app * **AI** - Configure general and AI autonomy settings for your team -* **Models** - Configure which models are available to your team and AWS Bedrock +* **Models** - Configure which models are available to your team, plus BYOLLM routing through AWS Bedrock or Gemini Enterprise * **Code** - Enable Codebase Context for your team * **Platform** - Configure cloud agent settings * **Privacy** - Configure user-generated content data collection, cloud conversation storage, and enterprise secret redaction diff --git a/src/content/docs/enterprise/index.mdx b/src/content/docs/enterprise/index.mdx index f0b86e04c..c9e69b85f 100644 --- a/src/content/docs/enterprise/index.mdx +++ b/src/content/docs/enterprise/index.mdx @@ -32,7 +32,7 @@ Warp Enterprise serves three primary audiences: * **SOC 2 Type II certified** - Meets enterprise security and compliance requirements * **Zero Data Retention (ZDR)** - No customer data is retained, stored, or used for training by contracted LLM providers * **Open source client** - Warp's client code is published under [AGPL v3](https://github.com/warpdotdev/warp/blob/master/LICENSE-AGPL) at [`warpdotdev/warp`](https://github.com/warpdotdev/warp) for security review and audit -* **Bring Your Own LLM (BYOLLM)** - Route inference through your own cloud infrastructure (AWS Bedrock) +* **Bring Your Own LLM (BYOLLM)** - Route inference through your own cloud infrastructure (AWS Bedrock or Google Cloud via Gemini Enterprise) * **Team-managed API keys and endpoints** - Share provider API keys and custom endpoints across your team for both interactive sessions and cloud agents * **Flexible deployment** - Choose Warp-hosted or hybrid deployment models * **Telemetry controls** - Configure what data is collected at the team level diff --git a/src/content/docs/enterprise/security-and-compliance/security-overview.mdx b/src/content/docs/enterprise/security-and-compliance/security-overview.mdx index f9741d17d..d2eb2c1bf 100644 --- a/src/content/docs/enterprise/security-and-compliance/security-overview.mdx +++ b/src/content/docs/enterprise/security-and-compliance/security-overview.mdx @@ -161,7 +161,7 @@ Security-relevant controls include: * **Privacy** - Configure user-generated content (UGC) data collection, cloud conversation storage, and enterprise secret redaction * **Sharing** - Restrict or permit direct link sharing and "anyone with link" sharing permissions * **AI** - Configure AI autonomy settings and general agent behavior for the team -* **Models** - Control which LLM models are available to team members, including AWS Bedrock +* **Models** - Control which LLM models are available to team members, including BYOLLM routing through AWS Bedrock and Gemini Enterprise (Vertex AI) * **Platform** - Configure cloud agent access and settings ## Security features for developers @@ -170,7 +170,7 @@ Security-relevant controls include: Route agent inference through your own cloud infrastructure for complete control: -* **Data locality** - Interactive agent inference runs in your AWS account +* **Data locality** - Interactive agent inference runs in your AWS account or Google Cloud project * **Cloud-native IAM** - Authenticate using your user's existing identity and access management process * **No key storage** - Warp never stores your cloud credentials or API keys * **Billing control** - Inference costs billed directly to your cloud account diff --git a/src/content/docs/enterprise/support-and-resources/billing.mdx b/src/content/docs/enterprise/support-and-resources/billing.mdx index beca4611d..72738381a 100644 --- a/src/content/docs/enterprise/support-and-resources/billing.mdx +++ b/src/content/docs/enterprise/support-and-resources/billing.mdx @@ -43,7 +43,7 @@ For more details, see [Access, Billing, and Identity](/platform/team-access-bill ## BYOLLM billing -When using [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/), Warp routes requests through your cloud infrastructure (AWS Bedrock today, with Azure Foundry and Google Vertex coming soon). BYOLLM requests **consume credits at a reduced rate** which is approximately 80% lower than standard usage. Inference costs are also billed directly to your cloud account. +When using [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/), Warp routes requests through your cloud infrastructure (AWS Bedrock and [Gemini Enterprise on Vertex AI](/enterprise/enterprise-features/byollm-gemini-enterprise/) today, with Azure Foundry coming soon). Customer-routed BYOLLM inference **consumes no AI credits** — Warp does not charge AI credits for requests that execute in your cloud. Inference costs are billed directly to your cloud account. Local agent runs that use BYOLLM still consume [platform credits](/support-and-community/plans-and-billing/platform-credits/) for Warp's platform infrastructure. If a BYOLLM request fails and Warp falls back to a direct API model, that fallback request consumes Warp credits at the standard rate. diff --git a/src/content/docs/enterprise/team-management/admin-panel.mdx b/src/content/docs/enterprise/team-management/admin-panel.mdx index bc735154c..be82c5462 100644 --- a/src/content/docs/enterprise/team-management/admin-panel.mdx +++ b/src/content/docs/enterprise/team-management/admin-panel.mdx @@ -213,7 +213,7 @@ When enabled, agents understand your code patterns, architecture, and convention ### Models settings -Control which LLM models are available to your team and how inference is routed. From the **Models** page, admins can enable or disable individual models and configure [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/) routing through AWS Bedrock. +Control which LLM models are available to your team and how inference is routed. From the **Models** page, admins can enable or disable individual models and configure [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/) routing through AWS Bedrock or [Gemini Enterprise (Vertex AI)](/enterprise/enterprise-features/byollm-gemini-enterprise/). From the **Models** page, admins can also configure [team-managed API keys and endpoints](/enterprise/enterprise-features/team-managed-keys-and-endpoints/) in the **Bring Your Own Keys & Endpoints** card, sharing provider keys and custom endpoints across the team for both interactive sessions and cloud agents. diff --git a/src/content/docs/platform/faqs.mdx b/src/content/docs/platform/faqs.mdx index e4f6a0c7f..7e2484ff7 100644 --- a/src/content/docs/platform/faqs.mdx +++ b/src/content/docs/platform/faqs.mdx @@ -221,7 +221,7 @@ Self-hosted agents can use any SCM accessible from your infrastructure. With the ### Do LLM requests still go through Warp with self-hosting? -Yes. LLM inference routes through Warp's backend, which has [Zero Data Retention (ZDR)](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr) agreements with all contracted model providers. Enterprise teams that need full control over inference routing can use [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/) to route inference through their own cloud provider accounts. BYOLLM currently applies to interactive (local) agents; cloud agent support is coming. +Yes. LLM inference routes through Warp's backend, which has [Zero Data Retention (ZDR)](/enterprise/security-and-compliance/security-overview/#zero-data-retention-zdr) agreements with all contracted model providers. Enterprise teams that need full control over inference routing can use [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/) to route inference through their own cloud provider accounts. AWS Bedrock BYOLLM supports both interactive agents and cloud agent runs; [Gemini Enterprise (Vertex AI)](/enterprise/enterprise-features/byollm-gemini-enterprise/) BYOLLM currently applies to interactive agents, with cloud agent support coming. ### What about large monorepos with long environment setup times? diff --git a/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx b/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx index 7fd66d867..807d8e5ed 100644 --- a/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx +++ b/src/content/docs/support-and-community/plans-and-billing/pricing-faqs.mdx @@ -288,7 +288,7 @@ On Business and Enterprise, local agent runs that use a custom inference endpoin ### Does Warp support other model routers or "Bring Your Own LLM"? -On the Enterprise plan, Warp's [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/) lets you route inference through major cloud-provider Model-as-a-Service offerings. BYOLLM currently supports AWS Bedrock, with Azure Foundry and Google Vertex coming soon. Warp still manages model support, routing, and orchestration, but inference runs in your cloud environment so you can maintain data locality, security controls, and existing cloud spend commitments. +On the Enterprise plan, Warp's [Bring Your Own LLM (BYOLLM)](/enterprise/enterprise-features/bring-your-own-llm/) lets you route inference through major cloud-provider Model-as-a-Service offerings. BYOLLM supports AWS Bedrock and [Gemini Enterprise (Vertex AI)](/enterprise/enterprise-features/byollm-gemini-enterprise/), with Azure Foundry coming soon. Warp still manages model support, routing, and orchestration, but inference runs in your cloud environment so you can maintain data locality, security controls, and existing cloud spend commitments. Custom or in-house model routers outside this list aren't supported by default today. If you have specific requirements, [contact our sales team](https://www.warp.dev/contact-sales). @@ -405,7 +405,7 @@ Here's how custom inference endpoints differ from BYOK and BYOLLM: * **BYOK** sends requests directly to OpenAI, Anthropic, or Google using your own provider API key. * **Custom inference endpoint** sends requests to any OpenAI-compatible URL you control or that your team runs. -* **BYOLLM** is an Enterprise-only managed inference feature. Warp routes traffic through your cloud provider (AWS Bedrock today, with Azure Foundry and Google Vertex coming soon) and handles the routing, orchestration, governance, and observability. +* **BYOLLM** is an Enterprise-only managed inference feature. Warp routes traffic through your cloud provider (AWS Bedrock and Gemini Enterprise on Vertex AI today, with Azure Foundry coming soon) and handles the routing, orchestration, governance, and observability. For setup and details, see [Custom inference endpoint](/agent-platform/inference/custom-inference-endpoint/). diff --git a/src/sidebar.ts b/src/sidebar.ts index 2fd67f52b..6216ee67f 100644 --- a/src/sidebar.ts +++ b/src/sidebar.ts @@ -637,6 +637,7 @@ export const sidebarTopics: StarlightSidebarTopicsUserConfig = [ items: [ { slug: 'enterprise/enterprise-features/architecture-and-deployment', label: 'Architecture and deployment' }, { slug: 'enterprise/enterprise-features/bring-your-own-llm', label: 'Bring your own LLM' }, + { slug: 'enterprise/enterprise-features/byollm-gemini-enterprise', label: 'BYOLLM: Gemini Enterprise' }, { slug: 'enterprise/enterprise-features/team-managed-keys-and-endpoints', label: 'Team-managed LLM keys and endpoints' }, { slug: 'enterprise/enterprise-features/analytics-api', label: 'Analytics API' }, ],