---
title: "AI accounts"
description: "Choose how Halon gets its AI, from Firefight's AI with an amount included every month to your own model provider's key, and what happens when it runs out."
canonical: https://firefight.app/docs/ai/ai-accounts
---

# AI accounts

Halon needs an AI model for everything it writes, from a chat answer to a postmortem draft. It gets one from your own AI accounts, which are your keys with a model provider such as Anthropic, OpenAI or Google Gemini, or from Firefight's own AI.

Halon always tries your own accounts first, from the top of the list, and moves on to Firefight's AI once none of them can answer.

| How Halon gets its AI | Where | What you do |
|---|---|---|
| Your own AI account | Everywhere | Add your provider's API key under **Settings → Workspace**, in **AI accounts** |
| Firefight's AI | Firefight's cloud | Nothing. An amount of AI is included every month, and you can add more under **Settings → Billing** |
| The server's AI keys | A Firefight you run yourself | Nothing. Halon uses the AI provider keys set up on the server Firefight runs on |

You first make this choice in setup, on the **Choose Halon's AI** step, which offers **Use my own AI account** and, where there is one, **Use Firefight's AI** or **Use this server's AI keys**. See [Setting up your workspace](https://firefight.app/docs/getting-started/setting-up#choose-halons-ai). You can change it later under **Settings → Workspace**.

Only admins see and change AI accounts, and only in the dashboard. They are not available over the API or MCP.

## Add an account

1. Open **Settings → Workspace** and find the **AI accounts** card.
2. Press **Add account**.
3. Choose the **Provider**. The form then asks for what that provider needs, such as an **API key**, a **Region** or a **Project ID**. Settings marked optional can stay empty.
4. Give the account a **Name** your team will recognize.
5. Check the **Main model** and the **Quick model**. Both start on the models Firefight recommends for the provider.
6. Press **Add and check**.

Firefight saves the account and checks it with one short call to the provider. A toast says whether it works. An account whose check fails is still saved, shows why in plain words, and Halon skips it until a check passes.

| Provider | What the form asks for |
|---|---|
| Anthropic, OpenAI, Google Gemini, OpenRouter, DeepSeek, Mistral, xAI | An API key. OpenAI also takes an organization ID and a project ID |
| Amazon Bedrock | An access key ID, a secret access key and a region. A session token for temporary credentials is optional |
| Google Vertex AI | A project ID, a location and a service account key, pasted as JSON |
| Azure AI Foundry | The API base URL of your resource, and an API key or an Entra ID token. You type the model names, since they are your deployments' names |
| Ollama, GPUStack | The API base URL of your server, and an API key if it needs one. Only on a Firefight you run yourself |

Most providers also take an **API base URL**, for a proxy or a regional endpoint. On Firefight's cloud the address must be a public one.

## Main and quick models

Each account runs two models. The **Main model** runs chats and investigations, and the postmortems that grow from them. The **Quick model** runs smaller tasks such as summaries, timeline notes, replies to mentions and helpers. See [AI models](https://firefight.app/docs/ai/models.md) for what each one does, the models Firefight recommends and what happens when one stops answering. A chat in the dashboard can also [switch to another model](https://firefight.app/docs/ai/chat#choosing-the-model).

Halon needs to know how much the main model can read at once, so a main model Firefight does not know is refused when you save. On a Firefight you run yourself, whoever runs it can add the model.

Code fixes need an Anthropic, OpenAI or OpenRouter account. When you pick another provider, the form says so, and a code fix uses the next account in the list that is one. See [Code fixes](https://firefight.app/docs/ai/models#code-fixes) for the models they run on.

## Keys stay hidden

A key is never shown again once saved. Editing an account shows only how it ends, such as "API key ending in 4f2a. Enter a new one to replace it." Leave the field empty to keep the saved key, or type a new one to replace it. **Save and check** checks the account again.

When Halon writes a code fix in Firefight's sandbox, the coding agent there never sees your key. Firefight makes the model calls for it.

## The order

Halon uses the first account in the list that works. Drag a row by its handle to change the order. The change saves as soon as you drop it.

When an account runs out of credit, or the provider refuses its key, Halon moves to the next account and carries on from where it was, even in the middle of an investigation. Each admin gets a direct message in Slack once, naming the account, with **Open AI accounts**.

The list says where each account stands.

| Status | What it means |
|---|---|
| **Works** | Its last check passed |
| **Not checked** | It has not been checked since it was saved |
| **Out of credit** | The provider refused a call because the account has no credit left. Halon skips it |
| **Key refused** | The provider refused the key. Halon skips it |
| **Off** | Someone turned it off with its switch. Halon skips it |

An account Halon skips is checked again every hour, and it is used again as soon as a check passes. Press **Check again** under its status to check it now, for example right after you add credit with the provider.

The card's description ends with what Halon uses once every account has been tried. On Firefight's cloud, that is Firefight's AI, as "After these, Halon uses your Firefight credits." On a Firefight you run yourself, it is the AI keys the server runs on. With nothing after your accounts, it says Halon needs at least one account that works.

## Turn off or delete an account

Use the switch in **Enabled** to stop Halon using an account without removing it. To remove it, open the row's menu, choose **Delete** and confirm. Its key is deleted for good, and the confirmation says what Halon uses after it. You can delete the last account too.

## Firefight's AI

On Firefight's cloud, Halon can run on Firefight's own AI account, so you need no API key. It does so whenever none of your own accounts can answer, and with no accounts in the list it runs on Firefight's AI alone.

Halon pays for Firefight's AI from two places, in this order:

1. **The [AI included every month](#included-ai).** Your workspace gets an amount of AI each month. Halon spends it first.
2. **[Firefight credits](#firefight-credits).** A balance you add to under **Settings → Billing**. Halon moves on to it once this month's included AI is used up.

The **Firefight credits** row under your AI accounts, on **Settings → Workspace**, shows how much of this month's included AI is used and left, the date it renews, then the credits Halon moves on to. Admins see a **Buy credits** button there that opens **Settings → Billing**.

## Included AI

On Firefight's cloud, your workspace gets an amount of AI included every month, and Halon spends it before anything else of Firefight's. **Included this month** under **Settings → Billing** shows it as a bar of how much is used and left, with the date it renews.

It renews once a month, on that date. What you did not use that month does not carry over, and the new month starts again at the full amount. Your credits are untouched when it renews.

Admins get an email and a direct message in Slack when most of the month's included AI is used, and again when it is used up. Each goes out once a month.

- **Credits left.** Halon carries on with your credits, and the message says how much is left.
- **No credits left.** Halon pauses until an admin adds credits, auto refill adds a pack, or the included AI renews. The message says which of these you can do.

## Firefight credits

Firefight credits are a balance Halon spends on Firefight's AI once this month's included AI is used up. You add credits in packs, and they never expire.

The **Firefight credits** section of **Settings → Billing** has:

- the **Balance** of your credits
- **Included this month**, a bar of how much of the month's included AI is used and left, and when it renews
- a button for each pack of credits you can add, which opens a checkout and adds the pack as soon as it goes through
- **Auto refill**
- **Spending**, what Halon spent from the included AI and credits over the last 30 days, by day and by what it was doing (investigations, chat, postmortems and so on)
- **Packs and refunds**, every pack added and anything taken back off the balance

Admins get an email and a direct message in Slack when most of the last pack added is used, and again when the balance runs out. Each goes out once for each pack.

Halon spends the included AI first. A call that takes your credits past zero still finishes, so the balance can end a little below zero. The section then says that amount comes off the next pack, and Halon makes no more calls on credits until you add some.

### Auto refill

Turn on **Auto refill** and Firefight adds the pack you added last again, on the card your workspace pays with, whenever what is left of the included AI and the balance together drops below the amount the section names. You need to have added a pack first. When what is left is already below that amount, turning it on adds the first pack right away, and the confirmation says so with **Turn on and buy now**. The switch turns it off again.

If a charge does not go through, auto refill pauses, admins get an email and a direct message, and the section shows what went wrong with **Update card** and **Try again**. Adding a pack by hand starts it again.

When auto refill is not available, the switch stays off and the section says why. Add packs by hand until it is.

## When nothing can pay

If no account in the list works and there is nothing to fall back on, Halon says so in place of an answer, and never names the provider. See [When Halon cannot answer](https://firefight.app/docs/ai/chat#when-halon-cannot-answer).

| You see | What to do |
|---|---|
| Halon cannot answer right now because this workspace has no AI account set up. An admin can fix this under Settings, Workspace, AI accounts. | Add an account |
| Halon cannot answer right now because this workspace's AI account is out of credit. An admin can fix this under Settings, Workspace, AI accounts. | Add credit with the provider, then press **Check again** |
| Halon cannot answer right now because this workspace's AI account refused its key. An admin can fix this under Settings, Workspace, AI accounts. | Edit the account and enter a working key |
| Halon cannot answer right now because this month's included AI is used up. An admin can top up under Settings, Billing. The included AI renews on November 15, 2026. | Add a pack of credits, add an AI account, or wait for the date it names |
| Halon cannot answer right now because this month's included AI and the workspace's Firefight credits are used up. An admin can top up or turn on auto refill under Settings, Billing. The included AI renews on November 15, 2026. | Add a pack, turn on auto refill, add an AI account, or wait for the date it names |

The date in the last two is the date your included AI renews.