CredentialLlmServiceFactory

Builds an LlmService from a user-supplied key, for a wire protocol the framework has no client for.

The second of two tiers, and the one to reach for last: it names LlmService, which lives in com.embabel.agent.spi - a package application code is asked not to depend on. Adding a provider that speaks the OpenAI or Anthropic protocol - which is nearly all of them - is a CredentialEndpointResolver returning a value instead, with no SPI type in sight.

embabel-agent-starter-byok ships an implementation per wire protocol, covering every provider BYOK supports - Anthropic, OpenAI, DeepSeek, Mistral, Gemini and Atlas Cloud - so per-user keys work with no application code at all; see com.embabel.agent.config.models.byok.CredentialEndpointConfig. The shipped beans stand aside for a bean of the same name, but replacing one that way also replaces the code that builds what CredentialEndpointResolvers resolve for that protocol.

Without a factory that handles the provider, a role resolving to RoleResolution.Credential fails with NoSuitableModelException and a log line naming the provider nothing handled.

Return null for a provider this factory does not handle, rather than building something: the platform tries each factory in turn, and a factory that answers for everything would hand back a client pointed at the wrong endpoint for someone else's key.

The platform caches what this returns, per (provider, key, model), so an implementation should build rather than maintain a cache of its own.