> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openwhispr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise providers

> Use your organization's AWS Bedrock account for AI text cleanup and Agent Mode — no personal API keys.

Enterprise mode points OpenWhispr at your organization's cloud LLM. AWS Bedrock is available today; Azure OpenAI and GCP Vertex AI are planned. Credentials resolve through the standard cloud SDK chain (SSO, assumed roles, env vars), so there's no personal API key to paste or proxy to run.

Use this when your team standardizes on a cloud provider and personal API keys aren't allowed on engineers' machines.

| Provider      | Status      |
| ------------- | ----------- |
| AWS Bedrock   | Available   |
| Azure OpenAI  | Coming soon |
| GCP Vertex AI | Coming soon |

## AWS Bedrock

### Prerequisites

* An AWS account with [Bedrock model access](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access-permissions.html) enabled for the models you want to use
* Either the [AWS CLI configured with SSO](https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html) OR an IAM user with `bedrock:InvokeModel` permissions

### Setup

1. Open **Settings > AI Text Enhancement > Enterprise > AWS Bedrock**

2. Pick an authentication method:

   <Tabs>
     <Tab title="SSO profile (recommended)">
       Enter the name of your AWS CLI profile (e.g. `default`, `my-sso-profile`).

       OpenWhispr uses `fromNodeProviderChain` to resolve credentials — any profile configured via `aws configure sso` or `aws configure` works.

       If the profile uses SSO, run `aws sso login --profile <name>` before using OpenWhispr. The connection test will surface a copy-paste command if your session has expired.
     </Tab>

     <Tab title="Access keys">
       Enter your IAM user's **Access Key ID** and **Secret Access Key**. Include a **Session Token** if you're using temporary credentials (e.g. from assume-role).
     </Tab>
   </Tabs>

3. Pick a **region** (e.g. `us-east-1`, `eu-west-1`)

4. Pick a model from the suggested list, click **Browse all models** to load your account's full Bedrock catalog, or enter a custom Bedrock model ID

5. Click **Test Connection** — a successful test means credentials resolve and the model is reachable

### Curated models

| Model            | Bedrock ID                                    | Use case                                                                         |
| ---------------- | --------------------------------------------- | -------------------------------------------------------------------------------- |
| Claude Fable 5   | `us.anthropic.claude-fable-5`                 | Most capable Claude model (Mythos-class) — best for the hardest Agent Mode tasks |
| Claude Haiku 4.5 | `us.anthropic.claude-haiku-4-5-20251001-v1:0` | Fast, cheap — recommended default for text cleanup                               |
| Claude Sonnet 5  | `us.anthropic.claude-sonnet-5`                | Balanced text cleanup and summarization                                          |
| Claude Opus 4.8  | `us.anthropic.claude-opus-4-8`                | Complex text cleanup and summarization                                           |
| GPT-OSS 120B     | `openai.gpt-oss-120b-1:0`                     | Open-weight OpenAI model                                                         |
| DeepSeek V3.2    | `deepseek.v3.2`                               | Open-weight reasoning model                                                      |
| Qwen3 Next 80B   | `qwen.qwen3-next-80b-a3b`                     | Open-weight, multilingual                                                        |

Model IDs are region-aware: the suggested list uses the cross-region inference profile prefix (`us.`, `eu.`, or `apac.`) that matches your selected region, and changing the region rewrites an already-picked model to the new geography. Click **Browse all models** to load your account's full Bedrock catalog live — resolved against your own credentials and region, so a picked model is always invocable — or enter a custom model ID for anything not in the list.

### Troubleshooting

| Error                      | Cause                                               | Fix                                                                |
| -------------------------- | --------------------------------------------------- | ------------------------------------------------------------------ |
| `AWS SSO session expired`  | SSO token timed out                                 | Run `aws sso login --profile <name>`                               |
| `Model access not enabled` | Model isn't enabled for your account in this region | Enable it in the AWS Bedrock console                               |
| `Model not found`          | Wrong model ID or wrong region                      | Check the ID format and that the model is available in your region |
| `Invalid AWS credentials`  | Access key/secret don't match an IAM user           | Double-check your keys in AWS IAM                                  |
| `Rate limited`             | Hit Bedrock quota                                   | Wait a moment and retry                                            |

The connection test surfaces all of these with copy-paste remediation commands where applicable.

## Agent Mode

Agent Mode (the AI agent overlay with tool-calling) now works with AWS Bedrock, not just text cleanup. Configure Bedrock under **Settings > AI Text Enhancement > Enterprise**, then select it in **Settings > Agent Mode**. Enterprise model streams are proxied through the app's main process for credential signing, so tools, step limits, and streaming behave the same as with the built-in providers.

## Credentials storage

Enterprise credentials are encrypted at rest using your OS keychain (Keychain on macOS, DPAPI on Windows, libsecret on Linux) via Electron's `safeStorage` API. They are never sent to OpenWhispr's servers.

Encrypted blobs live alongside your other secrets under the user-data directory:

* macOS: `~/Library/Application Support/OpenWhispr/secure-keys/`
* Windows: `%APPDATA%\OpenWhispr\secure-keys\`
* Linux: `~/.config/OpenWhispr/secure-keys/`

Non-secret preferences (regions, endpoints, model IDs) continue to live in `.env` in the same directory. On Linux systems without a keyring, secrets fall back to plaintext in `.env`.