Can we keep our current AI provider contracts with a gateway?

Summary

• Yes. On Databricks you register each provider you already pay, such as OpenAI, Anthropic or Amazon Bedrock, once as a model provider service in Unity Catalog. Unity Gateway then routes requests to that provider with the credential you supplied.
• Callers use a Databricks token, not your provider key. Databricks encrypts and stores the credential and does not return it on read.
• Unity Gateway adds Unity Catalog access control, rate limits, budgets and usage records. Spend for external models is an estimate from token usage and the provider's published prices, and the provider invoice remains the source of truth for actual charges.
• You can also use models hosted by Databricks, and one model service can mix both kinds of destination.
• Unity Gateway has been generally available since August 4, 2026. Counting external spend in budgets and relaying an existing Claude plan to Claude Code are in Beta.

Can we keep our current AI provider contracts with a gateway?

Yes. With Unity Gateway you register the provider account you already pay for, and your teams reach it through the gateway instead of holding the provider key themselves. Databricks documents how the credential, access, usage and estimated cost are handled. It does not speak for your agreement with the provider, so ask the owner of that contract whether routing through a gateway is allowed.

How does an existing provider connect to Unity Gateway?

You register each provider as a model provider service, a Unity Catalog object with a three-part name such as main.default.openai_prod. It holds the provider type, the connection settings and the credential. Documented providers and sign-in methods include:

Provider	Authentication
OpenAI	API key
Azure OpenAI	API key, or a Microsoft Entra ID service principal
Anthropic	API key
Amazon Bedrock	AWS access key pair, or a service credential
Microsoft Foundry	API key, or a Microsoft Entra ID service principal
Custom	Bearer token, or an API key sent in an HTTP header you name

Databricks encrypts and stores the credential and does not return it on read. You can instead back it with a Unity Catalog secret, so rotating the secret needs no change to the provider service. Callers need EXECUTE on the provider service, plus USE CATALOG and USE SCHEMA. They authenticate with a Databricks token, name the service in the Databricks-Model-Provider-Service header, and never see the stored credential.

What changes, and what stays with your provider?

Topic	What the Databricks documentation says
Billing	Databricks estimates external spend from token usage and the provider's published prices. For external model usage, the provider invoice is the source of truth for actual charges.
Negotiated pricing	Set a price multiplier on the provider service so estimates reflect your rates. It applies to every model on that service and to requests made after you set it.
Model scope	In the API, the targets setting allowlists the upstream models a provider service can reach.
Access	Unity Catalog privileges decide who can call a provider service or model service.
Limits	Rate limits on a model service count requests or tokens per minute, per service, per user or per group. A request over the limit gets HTTP 429. No limits are set by default.
Records	system.ai_gateway.usage logs each request, and usage tracking is a billed feature. system.ai_gateway.external_model_spend holds estimated spend, aggregated hourly.

A Unity Gateway budget can set shared and per-user monthly thresholds that send an alert or block usage. Counting external model usage in a budget is in Beta. Budgets are near real-time estimates, not an absolute cap on final billed amounts.

Can we keep an existing Claude plan?

For Claude Code only, yes, in Beta. A model provider service in Claude Max/Enterprise mode stores no credential. Unity Gateway relays each caller's own Anthropic OAuth token, requests are billed against the caller's Claude Pro, Max, Enterprise or Team plan and follow that plan's rate limits, and Unity Gateway governs access, routing and usage. An account admin must first enable the Enhanced Unity Gateway preview.

Can we mix providers and Databricks-hosted models?

Yes. A model service can route to Databricks-served models, using pay-per-token or provisioned throughput, or to external models through a model provider, and you can mix these destinations in one service. Traffic splitting spreads requests across up to five destinations by percentage. Fallbacks retry a failed request against backup destinations in the priority order you set, for example after a 429 or 5xx error. Applications keep calling the same service name while you change the models behind it.

FAQs

Do developers need our provider API key?

No. They authenticate with a Databricks token, and Unity Gateway supplies the stored credential. The base URL is your workspace URL followed by /ai-gateway.

Does the gateway replace our provider invoice?

No. Databricks provides external model spend for information only. The estimates might not match your final provider invoice, which stays the source of truth for external model charges.

Where is Unity Gateway available?

It needs Unity Catalog and a workspace in a supported region. It is not supported on AWS GovCloud.

What is still in Beta?

Counting external model usage in budgets and the Claude plan relay are in Beta. Service policies, which add guardrails to requests and responses, are also in Beta.