rajshah4 · Oct 3, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026
diff --git a/docs.json b/docs.json
@@ -612,6 +612,7 @@
               },
               "enterprise/integrations/slack",
               "enterprise/integrations/external-llm-gateways",
+              "enterprise/integrations/google-llm-gateway",
               "enterprise/integrations/observability-platforms"
             ]
           },

diff --git a/enterprise/integrations/google-llm-gateway.mdx b/enterprise/integrations/google-llm-gateway.mdx
@@ -0,0 +1,300 @@
+---
+title: Google LLM Gateway
+description: Connect Google AI Studio and Vertex AI models through the OpenHands Enterprise LLM gateway.
+icon: google
+---
+
+OpenHands Enterprise connects to Google models through its bundled LiteLLM
+gateway. These configurations apply whether OpenHands runs on GKE or another
+supported Kubernetes platform. The Helm examples configure Google credentials
+on the bundled gateway. Replicated also provides Vertex credentials to sandbox
+environments, as described below.
+
+Choose your installation method:
+
+- **Replicated**: configure the gateway in the Admin Console.
+- **Helm**: configure the gateway through your installation values.
+
+## Choose the Provider Route
+
+Choose the route that matches your Google credentials:
+
+| Route | Google Authentication | LiteLLM Model Prefix |
+| --- | --- | --- |
+| Google AI Studio (Gemini API) | Gemini API key | `gemini/` |
+| Google Cloud Platform (Vertex AI) | Google Cloud project, location, and service account | `vertex_ai/` |
+
+These are separate APIs, even when both serve a model named
+`gemini-2.5-flash`. In Replicated, the Admin Console selects one Google API
+type. A Helm installation can expose both as different gateway aliases.
+
+## Configure the Gateway
+
+<Tabs>
+<Tab title="Replicated">
+
+1. Open the [Admin Console LLM configuration](/enterprise/vm-install/admin-console-configuration#llm-configuration)
+   and select `Google` as the provider.
+2. Under `Google API Type`, choose one route:
+   - `Google AI Studio (Gemini API)`: enter the `Google Gemini API Key` from
+     [Google AI Studio](https://ai.google.dev/gemini-api/docs/api-key). In
+     `Gemini Models`, enter one model ID per line.
+   - `Google Cloud Platform (Vertex AI)`: enter the `Google Cloud Project ID`
+     and `Google Cloud Location`, then upload the `Google Cloud Service Account
+     JSON file`. In `Vertex AI Models`, enter one model ID per line. Enable the
+     Vertex AI API in the project and grant the service account the
+     [Vertex AI User role](https://docs.cloud.google.com/iam/docs/roles-permissions/aiplatform)
+     or equivalent model-inference permissions.
+3. Enter the raw model IDs, without a `gemini/` or `vertex_ai/` prefix. For
+   example, the Vertex field can contain:
+
+   ```text
+   gemini-2.5-flash
+   gemini-2.5-pro
+   ```
+
+   The Admin Console creates one bundled-gateway route per line, and the first
+   line becomes the installation default. Confirm that each model is available
+   to your account and, for Vertex, in your selected location.
+4. Save the configuration and deploy the updated version.
+
+The uploaded service-account file is used by the bundled gateway. Replicated
+also passes its JSON contents into sandbox environments as
+`VERTEXAI_CREDENTIALS`, together with the configured project and location. Scope
+that service account for this deployment behavior; do not assume its credential
+is available only to the gateway. Keep the file out of source control. The `Allow users to configure their own LLM providers
+(BYOK)` checkbox is separate from these administrator-managed models.
+
+</Tab>
+<Tab title="Helm">
+
+### Prerequisites
+
+- A working [OpenHands Enterprise Helm installation](/enterprise/k8s-install/installation).
+- A Google model that supports tool use and is available through your chosen
+  API. The examples use `gemini-2.5-flash`.
+- HTTPS access from the bundled LiteLLM pod to `generativelanguage.googleapis.com`
+  for Gemini API, or your Vertex API endpoint and `oauth2.googleapis.com` for Vertex.
+- For Vertex, a project with billing and the Vertex AI API enabled, a supported
+  model/location, and service-account inference permissions.
+- Enough model quota for agent prompts and tool definitions.
+
+Choose either route below, or add both to your **complete** installation
+`values.yaml`. Keep your existing `litellm-helm.proxy_config.model_list`,
+`environmentSecrets`, `volumes`, and `volumeMounts` entries when adding new
+ones: Helm replaces lists when applying overrides. Use distinct `model_name`
+aliases when both routes expose the same Google model ID.
+
+### Google AI Studio (Gemini API)
+
+Create a Kubernetes Secret from a private file containing your
+[Gemini API key](https://ai.google.dev/gemini-api/docs/api-key):
+
+```bash
+kubectl -n openhands create secret generic google-ai-studio-gateway \
+  --from-file=GOOGLE_API_KEY=/path/to/private/gemini-api-key
+```
+
+Add that Secret to the gateway's existing `environmentSecrets` list and append
+one route per model to `model_list`:
+
+```yaml
+litellm-helm:
+  environmentSecrets:
+    - litellm-env-secrets
+    - google-ai-studio-gateway
+  proxy_config:
+    model_list:
+      # Retain your existing model entries here.
+      - model_name: google-ai-studio-flash
+        litellm_params:
+          model: gemini/gemini-2.5-flash
+          api_key: os.environ/GOOGLE_API_KEY
+```
+
+The API key belongs to the LiteLLM gateway. It is separate from an OpenHands
+API key for conversations or automations.
+
+### Google Cloud Platform (Vertex AI)
+
+Enable Vertex AI in your Google Cloud project. Grant a dedicated service
+account the `roles/aiplatform.user` role or equivalent model-inference
+permissions, and confirm that `gemini-2.5-flash` is available in your chosen
+location. This example uses a service-account JSON file, matching the
+Replicated Admin Console path. Follow your organization's policy for
+[service-account key creation and rotation](https://cloud.google.com/iam/docs/keys-create-delete).
+A workstation `gcloud` login does not supply credentials to the LiteLLM pod.
+Create the Secret from a private file:
+
+```bash
+kubectl -n openhands create secret generic google-vertex-gateway \
+  --from-file=credentials.json=/path/to/private/service-account.json
+```
+
+Mount that Secret only in the bundled LiteLLM pod. Add one gateway route per
+model. Replace the project ID and location with your own:
+
+```yaml
+litellm-helm:
+  volumes:
+    # Retain any existing volumes here.
+    - name: google-vertex-credentials
+      secret:
+        secretName: google-vertex-gateway
+  volumeMounts:
+    # Retain any existing volume mounts here.
+    - name: google-vertex-credentials
+      mountPath: /etc/gcloud/vertex-credentials.json
+      subPath: credentials.json
+      readOnly: true
+  envVars:
+    GOOGLE_APPLICATION_CREDENTIALS: /etc/gcloud/vertex-credentials.json
+  proxy_config:
+    model_list:
+      # Retain your existing model entries here.
+      - model_name: google-vertex-flash
+        litellm_params:
+          model: vertex_ai/gemini-2.5-flash
+          vertex_project: <google-cloud-project-id>
+          vertex_location: us-central1
+```
+
+The credentials file, project, and location are used by LiteLLM to call
+Vertex AI. OpenHands and its sandboxes use the gateway alias; they do not
+need this file mounted into their pods.
+
+### Apply the Updated Values
+
+Use the licensed chart URL and version from your installation, then confirm
+the bundled gateway is ready:
+
+```bash
+helm upgrade openhands "$OPENHANDS_CHART_URL" \
+  --namespace openhands \
+  --version "$OPENHANDS_CHART_VERSION" \
+  --values values.yaml \
+  --wait --timeout 10m
+
+kubectl -n openhands rollout status deployment/openhands-litellm
+```
+
+Adjust the namespace, release name, and Deployment name if they differ in your
+installation. To make one of these aliases the installation default, set
+`env.LITELLM_DEFAULT_MODEL` to `litellm_proxy/<alias>` in the same values file.
+
+</Tab>
+</Tabs>
+
+## Select the Model in OpenHands
+
+For Replicated, select the Google models in the Admin Console and deploy the
+configuration. Users do not need to open LiteLLM or enter the Google credential.
+
+For Helm, set the desired gateway alias as the installation default in your
+complete values file before upgrading. For the Vertex example:
+
+```yaml
+env:
+  LITELLM_DEFAULT_MODEL: litellm_proxy/google-vertex-flash
+```
+
+For the Gemini API example, use `litellm_proxy/google-ai-studio-flash` instead.
+Users do not need a personal Google key to use an administrator-managed route.
+Configure the provider credential through your installation's Helm values or
+Admin Console; the Replicated credential distribution described above still applies.
+
+On the tested chart `0.74.0` / OpenHands `1.67.0`, a fresh user's `Default`
+profile resolved to `openhands/google-vertex-flash` with the internal gateway
+base URL `http://openhands-litellm.openhands.svc.cluster.local:4000`. No user
+profile override or provider key entry was required. Existing users may retain
+previously selected profiles; confirm the model selected for the new conversation.
+
+To offer both Helm aliases as administrator-managed profiles, open the
+organization's **Language Model (LLM)** defaults at `/settings/org-defaults`.
+Choose **Add LLM Profile → Advanced** and use the internal gateway URL:
+
+
+| Field | Vertex AI | Gemini API |
+| --- | --- | --- |
+| Name (Optional) | `Google-Vertex-Flash` | `Google-Gemini-Flash` |
+| Custom Model | `openhands/google-vertex-flash` | `openhands/google-ai-studio-flash` |
+| Base URL | `http://openhands-litellm.openhands.svc.cluster.local:4000` | `http://openhands-litellm.openhands.svc.cluster.local:4000` |
+
+OpenHands supplies the managed gateway credential, so no key entry is required.
+On OpenHands `1.67.0`, saving on this page also makes the profile the
+organization's active default. Re-activate the intended default after testing.
+
+Use your actual gateway Service name and namespace. The selected model points to
+the bundled gateway alias; configure its provider route through Helm values
+or the Replicated Admin Console.
+
+The Helm gateway calls Vertex AI. The sandbox calls the gateway, so this path does
+not require mounting Google credentials into the sandbox or rebuilding the
+agent-server image with `ENABLE_VERTEX=1`. That build flag applies when the
+agent-server calls `vertex_ai/*` directly; see
+[Vertex AI dependencies](/openhands/usage/llms/google-llms#vertex-ai-dependencies).
+
+## Start Using the Model
+
+1. Sign in and confirm the conversation UI loads without an additional backend
+   URL or API-key prompt. If it prompts, check the Canvas configuration in the
+   [Helm installation guide](/enterprise/k8s-install/installation).
+2. Start a new conversation using the installation's `Default` profile.
+3. Ask the agent to run `pwd`, create a small workspace file and read it back.
+4. Confirm the sandbox reaches `READY`, tool results contain the expected path
+   and file contents, and the agent completes its response. A successful direct
+   gateway request alone does not validate the OpenHands conversation path.
+
+<Note>
+The Vertex route passed end-to-end tests on GKE with Helm chart `0.74.0`,
+OpenHands `1.67.0`, agent-server `1.49.6-python`, and `gemini-2.5-flash` in
+`us-central1`. The unmodified agent-server image ran terminal and file tools
+and completed the conversation. A fresh conversation using a named organization
+profile also passed terminal file operations through the OpenHands API on this
+release. The organization defaults UI also saved the named Vertex profile with the
+expected URL. Fresh startup for that UI-created profile remains unvalidated. On Replicated release `0.74.0`, the Admin
+Console Vertex configuration also passed GitHub login, terminal file operations
+and a read-only repository conversation. The Gemini API examples were checked
+against the provider and chart configuration; they have not yet been validated
+with an end-to-end conversation in this evaluation.
+</Note>
+
+## Troubleshooting
+
+<AccordionGroup>
+<Accordion title="Google AI Studio authentication error">
+Check the Gemini API key in the Kubernetes Secret and confirm that it can use
+the selected model. The model route must use `gemini/`, not `vertex_ai/`.
+</Accordion>
+<Accordion title="Vertex AI permission or credential error">
+Check that Vertex AI is enabled, the service account can call the model, the
+Secret contains a valid JSON file, and the LiteLLM pod mounts it at the path
+in `GOOGLE_APPLICATION_CREDENTIALS`.
+</Accordion>
+<Accordion title="Model not found or unavailable">
+Check the model ID and the Google API type. For Vertex AI, also check the
+project and location. Model availability can differ between Google AI Studio
+and Vertex AI and across locations.
+</Accordion>
+<Accordion title="The profile cannot reach the gateway">
+Check the internal LiteLLM Service DNS name, namespace, and selected model alias.
+Confirm the LiteLLM Deployment is ready.
+</Accordion>
+<Accordion title="Google `429` or repeated retries">
+Check request and token quotas, billing, and model capacity for the chosen API.
+A small direct completion can succeed while a larger agent prompt is rate limited.
+</Accordion>
+<Accordion title="Sandbox cannot start">
+Check runtime registration, pod readiness and Kubernetes events using the
+[Troubleshooting guide](/enterprise/troubleshooting). For GKE, verify your Sysbox
+installation. A runtime startup failure does not by itself establish a Google
+credential problem.
+</Accordion>
+</AccordionGroup>
+
+For provider-specific configuration, see LiteLLM's
+[Google AI Studio](https://docs.litellm.ai/docs/providers/gemini) and
+[Vertex AI](https://docs.litellm.ai/docs/providers/vertex) references.
+
+If your organization uses an existing external gateway, follow
+[External LLM Gateways](/enterprise/integrations/external-llm-gateways).
diff --git a/enterprise/integrations/overview.mdx b/enterprise/integrations/overview.mdx
@@ -15,7 +15,7 @@
 | -------------- | ---------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
 | Purpose        | Purpose-built integrations for OpenHands Enterprise                                                                                | Extend agent access to external systems through MCP servers                             |
 | Data flow      | Bidirectional (outbound and event-driven)                                                                                          | Unidirectional (outbound only)                                                          |
 | Integrations   | Git and ticketing providers: GitHub, GitLab, Bitbucket Cloud, Bitbucket Data Center, Azure DevOps, Jira Cloud, Jira Data Center, Slack | Large MCP catalog across multiple integration categories                                |
 | Authentication | OAuth                                                                                                                              | OAuth or bearer token                                                                   |
 | Administration | Super admins enable or disable specific integrations and configure their OAuth app IDs, client IDs, and client secrets             | End users manage their own MCP connections                                              |
 | Navigation     | `Settings > Integrations`                                                                                                          | `Customize > MCP Servers`                                                               |
@@ -55,7 +55,7 @@
    Configure Bitbucket Data Center sign-in and repository webhooks.
  </Card>
  <Card title="Azure DevOps" icon="microsoft" href="/enterprise/integrations/azure-devops">
    Connect Azure Repos and Azure Boards with Microsoft Entra ID sign-in.
  </Card>
 </CardGroup>

@@ -66,10 +66,10 @@

 <CardGroup cols={2}>
  <Card title="Jira Cloud" icon="jira" href="/enterprise/integrations/jira-cloud">
    Start OpenHands from Jira Cloud issues with a mention or label.
  </Card>
  <Card title="Jira Data Center" icon="jira" href="/enterprise/integrations/jira-data-center">
    Start OpenHands from Jira Data Center issues with a mention or label.
  </Card>
 </CardGroup>

@@ -91,7 +91,7 @@

 <CardGroup cols={2}>
  <Card title="SAML SSO" icon="user-shield" href="/enterprise/integrations/saml-sso">
    Let users sign in with Okta, Microsoft Entra ID, Google Workspace, ADFS, or Authentik.
  </Card>
 </CardGroup>

@@ -102,31 +102,31 @@

 ### Integration Coverage

 - **Fetch repos**: Fetch and clone repositories (Git providers only).
 - **Resolver**: Use OpenHands in conversations, issues, and pull requests.
 - **Auth IdP**: Sign in to OpenHands Enterprise through the integration.

 | Integration                                                                                                  | Fetch repos     | Resolver                                                                                                                  | Auth IdP                       |
 | ------------------------------------------------------------------------------------------------------------ | --------------- | ------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
 | [GitHub](/enterprise/integrations/github)                                                                    | ✅              | ✅                                                                                                                        | ✅ GitHub App sign-in          |
 | [GitLab](/enterprise/integrations/gitlab) (SaaS and self-managed)                                            | ✅              | ✅                                                                                                                        | ✅                             |
 | [Bitbucket Data Center](/enterprise/integrations/bitbucket-data-center)                                      | ✅              | ✅                                                                                                                        | ✅                             |
 | [Bitbucket Cloud](/openhands/usage/cloud/bitbucket-installation)                                             | ✅              | ❌                                                                                                                        | ❌                             |
 | [Azure DevOps](/enterprise/integrations/azure-devops)                                                        | ✅ Azure Repos  | Supported, but requires an [event-based automation](/enterprise/integrations/azure-devops#trigger-openhands-from-azure-devops) | ✅ Microsoft Entra ID          |
 | [Jira Cloud](/enterprise/integrations/jira-cloud)                                                            | N/A             | ✅                                                                                                                        | ❌                             |
 | [Jira Data Center](/enterprise/integrations/jira-data-center)                                                | N/A             | ✅                                                                                                                        | ❌                             |
 | [Slack](/enterprise/integrations/slack)                                                                      | N/A             | ✅                                                                                                                        | N/A                            |
 | [SAML SSO](/enterprise/integrations/saml-sso) (Okta, Entra ID, Google Workspace, ADFS, Authentik)            | N/A             | N/A                                                                                                                       | ✅ Recommended sign-in method  |

 ## MCP Server Integrations

 MCP server integrations provide additional ways for users to connect external systems to OpenHands. They support
 multiple server types, including SSE, streamable HTTP (SHTTP), and stdio, as well as authentication methods such as
 bearer tokens and OAuth.

 Examples include:

 - **OAuth-enabled**: Atlassian Rovo, GitLab, Granola
 - **Token-enabled**: Linear, Notion

 Unlike built-in integrations, MCP servers are **unidirectional**: the OpenHands agent calls the MCP server to access data,
@@ -134,13 +134,16 @@

 See [MCP Settings](/openhands/usage/settings/mcp-settings) to add and configure MCP servers.

 ## Agentic Infrastructure

 <CardGroup cols={2}>
   <Card title="External LLM Gateways" icon="network-wired" href="/enterprise/integrations/external-llm-gateways">
     Route LLM traffic through your existing LiteLLM or Bifrost gateway for routing, cost tracking, and audit.
   </Card>
+  <Card title="Google Models" icon="google" href="/enterprise/integrations/google-llm-gateway">
+    Connect Vertex AI and Gemini API models through the bundled gateway on Replicated or Helm.
+  </Card>
   <Card title="External Observability Platforms" icon="chart-line" href="/enterprise/integrations/observability-platforms">
     Send conversation traces to your own OTLP-compatible platform, such as Langfuse, Honeycomb, or Tempo.
   </Card>
 </CardGroup>
diff --git a/enterprise/k8s-install/installation.mdx b/enterprise/k8s-install/installation.mdx
@@ -33,7 +33,7 @@
  `app.openhands.example.com` (application), `auth.openhands.example.com`
  (login), `runtime-api.openhands.example.com`, and
  `<id>-runtime.openhands.example.com` for the per-session sandboxes. Every
  hostname sits one label under the base domain, so a single **wildcard**
  record `*.openhands.example.com` pointing at your cluster's ingress covers
  all of them; see [DNS and TLS](/enterprise/k8s-install/dns-and-tls).
 - A **wildcard TLS certificate** for `*.openhands.example.com`, which you provide.
@@ -54,12 +54,12 @@
 unset OH_LICENSE_ID
 ```

 ## Step 2: Create the namespaces and secrets

 We recommend running agent sandboxes in a namespace separate from the
 application. Sandboxes run agent-authored code, so a dedicated namespace keeps
 them isolated from the application, database, and secrets. Create both
 namespaces now:

 ```bash
 kubectl create namespace openhands
@@ -67,7 +67,7 @@
 ```

 The chart references several Kubernetes secrets that you create ahead of
 installation, all in the `openhands` namespace:

 ```bash
 kubectl -n openhands create secret generic jwt-secret \
@@ -162,7 +162,7 @@
  data.
 </Warning>

 The example below uses Traefik, the chart's default ingress class; set
 `ingress.class` and the annotations to match your controller.

 ```yaml
@@ -312,7 +312,7 @@
 ```

 <Tip>
  The `preflight` and `support-bundle` CLIs are both part of
  [Troubleshoot](https://troubleshoot.sh/docs/#installation). Install them with:

  ```bash
@@ -321,7 +321,7 @@
  ```
 </Tip>

 Then confirm the application is reachable at your configured hostname and log
 in. A complete first-use check goes beyond Ready pods and preflight:

 1. Open `https://app.openhands.example.com` and sign in through your configured
@@ -358,6 +358,9 @@
   <Card title="Analytics" icon="chart-line" href="/enterprise/analytics">
     Enable conversation analytics with Laminar.
   </Card>
+  <Card title="Google Models" icon="google" href="/enterprise/integrations/google-llm-gateway">
+    Configure Vertex AI or Gemini API routes in the bundled gateway.
+  </Card>
   <Card title="Automations" icon="clock" href="/enterprise/k8s-install/automations">
     Run scheduled or event-triggered tasks on a Helm installation.
   </Card>

diff --git a/enterprise/vm-install/admin-console-configuration.mdx b/enterprise/vm-install/admin-console-configuration.mdx
@@ -36,14 +36,14 @@

 ### Recommended: Simple

 Use the default `Simple` mode unless your organization requires a custom hostname for each service.

 1. Leave `Hostname Configuration Mode` set to `Simple (default)`.
 2. Enter your `Base Domain`, such as `openhands.example.com`.

 Every hostname sits one subdomain under the base domain, so a single wildcard DNS record and TLS certificate for `*.openhands.example.com` cover all of them:

 | Service | Hostname |
 |---|---|
 | Admin Console | `admin.openhands.example.com:30000` |
 | OpenHands application | `app.openhands.example.com` |
@@ -54,7 +54,7 @@
 | Sandboxes | `<id>-runtime.openhands.example.com` |

 <Note>
  Installations created before the Simple layout run in `Legacy` mode, which nests some hostnames deeper (`auth.app.<base>`, `*.runtime.<base>`). Keep existing installs on Legacy; their certificates and OAuth callbacks were issued for those hostnames.
 </Note>

 <Accordion title="Customize every hostname">
@@ -62,19 +62,19 @@

  | Field | Description |
  |---|---|
  | `Application Hostname` | Hostname for the OpenHands application. |
  | `Analytics Hostname` | Hostname for the analytics service. |
  | `Authentication Hostname` | Hostname for Keycloak. |
  | `LLM Proxy Hostname` | Hostname for the bundled LiteLLM proxy. |
  | `Runtime API Hostname` | Hostname for the Runtime API. |
  | `Runtime Base Hostname` | Base hostname used to create sandbox routes. |

  You must create DNS records, issue certificates, and configure external OAuth and webhook callbacks for the complete custom hostname set.
 </Accordion>

 ### Additional CORS Origins

 `Additional Permitted CORS Origins` is optional in either hostname mode. Enter a comma-separated list of browser origins, including the scheme and host with no path or trailing slash. The OpenHands application origin is always allowed automatically.

 ## Certificate Configuration

@@ -99,7 +99,7 @@
 | `Google` | Google AI Studio API key, or Vertex AI project, location, service-account file, and model IDs |
 | `DeepSeek` | API key |
 | `Mistral AI` | API key |
 | `Azure` | Authentication method, endpoint, API version, deployment names, and either an API key or Microsoft Entra service-principal credentials |
 | `Groq` | API key |
 | `OpenRouter` | API key |
 | `AWS Bedrock` | Authentication method, AWS Region, model IDs, and optionally an access-key pair |
@@ -111,6 +111,7 @@
 - For AWS Bedrock, use an EC2 instance profile where possible. Pods must be able to reach the instance metadata service, and the role needs model invocation permissions.
 - For custom OpenAI-compatible endpoints, prefix model names with `openai/`.
 - Model lists accept one model per line.
+- For Google, see [Google LLM Gateway](/enterprise/integrations/google-llm-gateway) for Vertex AI and Gemini API configuration and verification.
 
 ### Bring Your Own Key
 
@@ -142,11 +143,11 @@

 ### Azure DevOps Authentication

 Configure the Microsoft Entra tenant, Azure DevOps organization, client ID, and client secret. See [Azure DevOps](/enterprise/integrations/azure-devops).

 ### Jira Data Center Integration

 Configure the Jira base URL, account-linking method, and either OAuth or service-account credentials. See [Jira Data Center](/enterprise/integrations/jira-data-center).

 ### GitHub Authentication

@@ -163,7 +164,7 @@

 ### GitLab Authentication

 Provide the GitLab host and OAuth client credentials. Leave the host at `gitlab.com` for GitLab SaaS, or enter the hostname of your self-managed GitLab instance.

 ### Slack

@@ -175,7 +176,7 @@

 | Field | Description |
 |---|---|
 | `SMTP Host` | SMTP server hostname. |
 | `SMTP Port` | SMTP server port. The default is `587`. |
 | `SMTP From Email` | Sender address for OpenHands notifications. |
 | `Use SMTP SSL` | Uses implicit TLS/SMTPS. |
@@ -195,7 +196,7 @@
 - SSL mode
 - Username and password
 - Whether OpenHands should create databases automatically
 - Database names for OpenHands, Keycloak, LiteLLM, Runtime API, and Automations

 See [External PostgreSQL](/enterprise/external-postgres) for version, encoding, privilege, and database requirements.

@@ -244,7 +245,7 @@
 |---|---|
 | `HTTP_PROXY` | Proxy URL for HTTP traffic. |
 | `HTTPS_PROXY` | Proxy URL for HTTPS traffic. |
 | `NO_PROXY` | Additional comma-separated hosts that bypass the proxy. OpenHands adds internal services and configured deployment hostnames automatically. |
 | `SSL Verification` | Verifies outbound TLS certificates. Keep enabled unless a trusted proxy configuration requires otherwise. |

 Prefer adding the proxy CA under `Additional Trusted CA Certificates` instead of disabling TLS verification.
@@ -268,11 +269,11 @@

 See [Analytics](/enterprise/analytics) for the complete setup and verification flow.

 ## Automations

 `Enable Automations` deploys the Automations UI and backend.

 If you use external PostgreSQL, create and grant access to the Automations database before enabling this option.

 ## Advanced Options

@@ -290,10 +291,10 @@

 ## Installer-Managed Secrets

 Replicated generates internal PostgreSQL, Redis, JWT, Keycloak, LiteLLM, sandbox, plugin-directory, and Automations secrets during installation. These values are intentionally hidden from the configuration screen.

 <Warning>
  Do not rotate installer-managed secrets manually unless OpenHands Support provides a component-specific procedure. In particular, changing the LiteLLM salt key makes provider credentials already stored by LiteLLM undecryptable.
 </Warning>

 ## Related Guides