# ITenantCredentialModelProvider

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/api/tracon.itenantcredentialmodelprovider/
> Summary: ITenantCredentialModelProvider: A model provider that can build clients from resolved per-tenant credentials.

<div class="api-provenance">Namespace Tracon · Assembly <code>Tracon.Abstractions.dll</code></div>

A model provider that can build clients from resolved per-tenant credentials.

```csharp
public interface ITenantCredentialModelProvider : IModelProvider
```

<dl class="api-relations"><dt>Implements</dt><dd><a href="/api/tracon.imodelprovider/">IModelProvider</a></dd></dl>

## Remarks

Implement this interface only when the provider supports tenant-provided
credentials. A provider that implements only [IModelProvider](/api/tracon.imodelprovider/)
continues to use its setup-time credential. If a tenant binding exists for
such a provider, Tracon fails before invoking the provider and never
falls back to the setup-time credential.

A compiled agent's chat client is a fixed pipeline object. A client built
with a tenant credential is therefore never stored in the shared compile
cache. The registry enforces this through
[IModelProviderRegistry.HasTenantProviderOverrideAsync](/api/tracon.imodelproviderregistry/#Tracon_IModelProviderRegistry_HasTenantProviderOverrideAsync_Tracon_ModelBinding_System_Threading_CancellationToken_).

## Methods

### <a id="Tracon_ITenantCredentialModelProvider_CreateChatClient_Tracon_ModelBinding_Tracon_ModelProviderCredential_"></a> CreateChatClient\(ModelBinding, ModelProviderCredential\)

Produces a raw chat client using a resolved tenant credential.

```csharp
IChatClient CreateChatClient(ModelBinding binding, ModelProviderCredential credential)
```

#### Parameters

`binding` [ModelBinding](/api/tracon.modelbinding/)

The model binding.

`credential` [ModelProviderCredential](/api/tracon.modelprovidercredential/)

The non-null tenant credential.

#### Returns

 IChatClient

The provider-specific raw chat client.

#### Remarks

The implementation uses [ModelProviderCredential.ApiKey](/api/tracon.modelprovidercredential/#Tracon_ModelProviderCredential_ApiKey)
and, when present, [ModelProviderCredential.Endpoint](/api/tracon.modelprovidercredential/#Tracon_ModelProviderCredential_Endpoint).
The API key must never fall back to the setup-time key. An endpoint may
fall back to a setup-time endpoint when only the key is overridden.