Deployment Management Dashboard

The Admin Dashboard has a Deployment page (visible only to super-admins) where you manage the deployment itself — version updates, authentication, custom domains, super-admins, and LLM provider keys.

The page heading reads Deployment Configuration with subtitle "Manage stack updates and configure deployment overrides."

It's separate from the parts of the Admin Dashboard that manage agents inside the platform; this page manages the platform itself.

备注

This page is only visible to super-admins. If you don't see the Deployment item in the navigation drawer, your account doesn't have super-admin rights. Contact whoever set up the deployment to get access or to make changes.

Who can use it

Only the super-admins of the deployment. The page isn't even visible to regular admins. See Super-admin.

How to get there

Sign into the Admin Dashboard with a super-admin account → click Deployment in the left nav.

What's on it

Deployment Info (read-only)

A collapsible summary panel at the top showing:

Field	What it is
Deployment ID	Your unique deployment identifier.
Domain Name Prefix	The subdomain prefix (e.g., bxmqxnlxtx).
Dashboard URL	The public URL for the dashboards (e.g., https://bxmqxnlxtx.evaluation.esp-private-agents.com).
API URL	The public URL for the API and devices (e.g., https://api.bxmqxnlxtx.evaluation.esp-private-agents.com).

Three tabs

Updates

Shows the current installed version, lists newer versions available, and lets you trigger an update. See Updating.

Configuration

The big one. Several editable sections (each is a collapsible accordion — click to expand):

• Super Admins — manage the email addresses with super-admin authority on this deployment. See Super Admins below.
• User Authentication (Cognito) — User Pool ID, Client ID, Domain. Override the default end-user pool.
• Admin Authentication (Cognito) — Admin Pool ID, Client ID, Domain. Override the default admin pool.
• Custom Domain — Dashboard Domain, API Domain, Gateway Certificate ARN, Dashboard Certificate ARN, and Additional CORS Origins (extra origins allowed by the gateway and media bucket; the dashboard origin is always allowed). See Custom Domain → Additional CORS origins.
• LLM Provider API Keys — keys for non-Bedrock providers (Anthropic, OpenAI, Google, etc.). KMS-encrypted at rest. See LLM Provider API Keys below.

Every override field has a default (auto-created during deployment) and an override. Leave blank to keep the default; fill in to override.

A Save Configuration button at the bottom commits your overrides.

Defaults

Read-only view of everything the installer auto-created — useful when you're trying to figure out what an override is replacing.

Default vs. override

The dashboard makes the distinction clear. For each field you'll see:

• Default — what was created automatically by the installer.
• Current — what's actually in use right now (override if set, otherwise default).
• Override — your custom value. Empty means "use default".

You can experiment with overrides and reset to default by clearing the override.

Super Admins

Found in Deployment → Configuration tab → Super Admins.

This is where super-admin email addresses are managed. Admins listed here have full access to the Deployment page. Add or remove emails from the comma-separated list.

备注

Changes to super-admin emails require a stack update to take effect. After saving, trigger a stack update from the Updates tab.

LLM Provider API Keys

Found in Deployment → Configuration tab → LLM Provider API Keys.

For LLMs not hosted on Amazon Bedrock, the gateway needs a provider API key. Bedrock models use the gateway's IAM role and do not require a key.

Supported providers

Provider name in UI	Notes
Anthropic API Key	For direct Anthropic API access (Claude models).
OpenAI API Key	For OpenAI models (GPT-5.5, o3, etc.).
Google AI Studio API Key	For Google Gemini models.
xAI API Key	For Grok models.
Moonshot Kimi API Key	For Moonshot Kimi direct API. Also has an optional Moonshot base URL field.
Alibaba DashScope API Key	For Alibaba Qwen models.
DeepSeek API Key	For DeepSeek direct API.

Models from providers listed as Bedrock-hosted (Z.AI GLM, MiniMax, Qwen3 via Bedrock, DeepSeek via Bedrock) use IAM access and do not need an API key entry here.

Adding or updating a key

1. Expand the LLM Provider API Keys accordion.
2. Find the provider you want to configure.
3. Paste the API key.
4. Fill in any optional fields if shown (e.g., Moonshot base URL).
5. Click Test connection for that provider — the platform makes a test call to confirm the key is valid.
6. Click Save Configuration at the bottom of the page.

备注

Each provider entry has its own Test connection button — this tests that specific provider, not all keys globally.

The gateway picks up the new key automatically within a few seconds of saving. If models from a newly configured provider don't appear in the agent editor's model dropdown immediately, wait a moment and refresh.

Key storage

• Stored encrypted in DynamoDB.
• Encrypted with the deployment's KMS key.
• Only the gateway's IAM role can decrypt.
• The dashboard shows only a masked status ("Configured" badge) — never plaintext.

Rotating a key

1. Generate the new key in the provider's console.
2. Open Deployment → Configuration → LLM Provider API Keys.
3. Replace the value for that provider.
4. Click Test connection to confirm the new key works.
5. Click Save Configuration.
6. Revoke the old key in the provider's console once the new one is confirmed active.

Which models appear in the agent editor

A model from the catalog appears in the agent editor's model dropdown only if:

• It is a Bedrock model and the gateway's IAM role has Bedrock access for it, or
• Its provider has a configured (non-empty) API key in this section.

If admins report that a provider's models are missing from the dropdown, check this section for the corresponding key.

What you'd typically change

Reason	Section to use
Use one Cognito pool for both admins and end users	User + Admin Authentication — set both to the same pool
Use your own existing Cognito pool (e.g. RainMaker)	User + Admin Authentication — paste your pool's IDs
Host on agent.yourcompany.com instead of the default	Custom Domain
Embed the chat agent on another site (or any extra origin)	Custom Domain → Additional CORS Origins
Add or rotate an Anthropic / OpenAI / etc. API key	LLM Provider API Keys
Apply a new platform version	Updates tab
Add another super-admin	Super Admins

What you can't change here

• Deployment ID — fixed at deploy time.
• AWS region — chosen at deployment.
• The very first super-admin (the email passed in the CloudFormation parameter) — additional super-admins can be added/removed here, but the deployment-time one is locked.
• Anything inside the platform (agents, tools, end users) — those live in the regular Admin and User dashboards.

Tips

• Read Authentication before changing pool fields. Cognito-related changes have follow-on requirements (callback URLs).
• After saving, give it a minute. Some changes propagate immediately; ECS-deployed changes can take a few minutes.
• Domain changes pair with cert changes. If you change Dashboard Domain, you almost always also need to update Dashboard Certificate ARN.
• LLM keys take effect automatically. After saving a new provider key, give the gateway a minute and refresh — there's no manual restart required.
• Use one key per provider per deployment. Rolling per-agent keys is not currently supported.
• Keep a key store outside the platform. Use your team's password manager or secrets manager so you can rotate without losing access.
• Test before saving. The per-provider Test connection button catches most key errors immediately — typos, rate limits, expired keys.
• Don't share credentials in chat. Keys should move via your secrets store, never via Slack or email.

What's next

• Authentication
• Custom domain
• Updating