> ## Documentation Index
> Fetch the complete documentation index at: https://docs.interchange.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Generative creative provider credentials

> How creative provider accounts and model keys are connected, mapped, and rotated

Organizations with generative creative enabled can connect provider API keys
for OpenAI, Gemini, and fal.ai. The key determines whose provider account pays
the model cost; it does not change which Interchange organization owns the
campaign or advertiser.

AudioStack and ElevenLabs credentials are managed under **Settings →
Connections → Creative tools**. In **Advertiser mapping**, map the AudioStack
or ElevenLabs access grant to each advertiser. The mapping determines which
provider tenant is billed. Generation for an advertiser without a
mapping fails before it starts; Interchange never falls back to another
provider account.

Replacing an AudioStack or ElevenLabs key creates a new access-grant identity.
Confirm its advertiser mappings again before generation resumes. This prevents
a key for a different provider tenant from inheriting the previous tenant's
mappings.

## How an OpenAI, Gemini, or fal.ai key is selected

Provider keys belong to the organization and have a label. You can assign one
key to several advertisers or mark one key as the organization default for that
provider.

When generation starts, an advertiser-assigned key takes precedence. If the
advertiser has no assigned key, Interchange uses the provider default only when
you explicitly set one. It never silently chooses another key, because that
could charge the wrong provider account.

## Rotate a key

In **Settings → Generative creative**, open the key's action menu and choose
**Rotate key**. Enter the replacement API key and confirm.

Rotation preserves the credential's label, advertiser assignments, and default
status. The existing key remains active unless the replacement is stored and
the credential is switched successfully. After the switch, Interchange retires
the old stored secret.

You can also rotate through the buyer API:

```http theme={null}
PATCH /api/v2/buyer/creative/model-credentials/{credentialId}
Content-Type: application/json

{ "apiKey": "your-replacement-provider-key" }
```

Provider keys are stored encrypted and are never returned by the API. List
responses include only a masked hint.

## Provider costs and Intelligence Units

Creative generated with your provider key is charged by that provider to your
provider account. Buyer-funded provider attempts are excluded from
Interchange's generated-media IU meter, including retries and discarded
variants.

AudioStack and ElevenLabs remain bring-your-own-key regardless of the
organization's other billing settings. Their credentials are managed on the
provider connection, not in **Settings → Generative creative**.

The mapped provider account controls billing; voice selection is independent.
Set the brand's durable default voice with `brand.voice_synthesis`, or set
transformer `voice_id` to override it for one build.