---
title: AI Chat in the admin
description: Configure NexCMP by chatting in the admin: choose an AI source, review confirmation cards for every change, pass secrets safely and keep a daily spending cap.
url: https://nexcmp.com/docs/configure-with-ai/ai-chat-in-admin/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# AI Chat in the admin

> **Where in the admin:** AI Chat (`/agent`, its own menu entry) and the floating **Ask AI** button on every admin page. The answer sources are set up in System › Settings › AI accounts (`/agent/accounts`).

## What it does

AI Chat is an assistant built into the admin. You describe what you want ("connect my Proxmox cluster", "set up email"), the assistant reads the current state with the admin tools, proposes changes and shows each one as a **confirmation card**. Nothing is applied until you press **Confirm**. The **Ask AI** panel is the same chat in a narrow side panel, so you can ask while you look at a page. Buttons such as **Do it for me** (in the [Setup progress checklist](https://nexcmp.com/docs/configure-with-ai/setup-checklist/) and in empty lists) open it with a ready question.

It is not the customer-facing [AI Chat](https://nexcmp.com/docs/ai/ai-chat/) and [AI Agent](https://nexcmp.com/docs/ai/ai-agent/), which serve your customers.

## Requirements

| Item | Requirement |
|---|---|
| Role | A signed-in administrator. Chats, keys and preferences belong to your admin account; other administrators do not see them. |
| An answer source | At least one connected: an API key, a sign-in, the panel's own AI provider, or an AI CLI you signed in to. See [AI accounts and subscriptions](https://nexcmp.com/docs/configure-with-ai/ai-accounts-and-subscriptions/). |
| Demo | On a demo panel you can read old chats but not send messages. |

## Choose where answers come from

Pick the source in the selector under the input (it lists the sources you have connected). **System › Settings › AI accounts** also lets you set a default source, a default model and the daily cap.

| Source | How you connect it | Notes |
|---|---|---|
| OpenAI (ChatGPT models) | Paste an API key from platform.openai.com | Billed by OpenAI per use. |
| Anthropic (Claude) | Paste an API key from console.anthropic.com | Billed by Anthropic per use. |
| Google Gemini | Paste an API key from aistudio.google.com, or **Sign in with Google** | Signing in with Google needs an OAuth client that **you** create in your own Google Cloud project. |
| OpenRouter | Paste a key, or **Sign in with OpenRouter** | One account for many models. |
| Panel AI provider | Already set in System › Settings › AI provider | The same provider your customers' AI Chat uses. [AI provider](https://nexcmp.com/docs/ai/ai-providers/). |
| Claude, ChatGPT or Gemini subscription | Official CLI installed and signed in on the panel server | See [AI accounts and subscriptions](https://nexcmp.com/docs/configure-with-ai/ai-accounts-and-subscriptions/). |

Keys you paste are stored encrypted for your admin account only. They are never shown again and another administrator cannot decrypt them.

## Use the chat

1. Open **AI Chat** (or click **Ask AI**).
2. Click **New chat**, or open an earlier one from the list on the left.
3. Type your request and press Enter (Shift+Enter starts a new line). You can attach images or text files (up to 4 per message, 3 MB each) to show an error or paste a document.
4. Watch the answer stream in. Each tool the assistant calls appears as a collapsible card with the tool name, its arguments and a short result.
5. Press **Stop** to cancel a running answer. Only one answer runs at a time per administrator.

![AI Chat with the conversation list, an answer containing tool cards and the input with source selector and Secret field](https://nexcmp.com/docs/images/configure-with-ai/ai-chat-in-admin-01-chat.webp)

Up to 10 tool rounds happen per message. The assistant remembers the last 30 messages of the chat. Results from tools are passed to the model marked as data, not as instructions.

## Confirmation cards

In AI Chat **every change is a card**, not only money actions. The assistant proposes; you decide.

A card shows:

- A title that says why it needs attention, for example "changes a customer balance".
- The call: method and path.
- A table of the fields that change: the current value and the new one. Secret values appear as `••••`.
- A countdown (cards expire after 5 minutes).
- **Confirm** and **Reject**.

**Confirm** makes the panel itself apply the change, then tells the assistant what happened. The assistant cannot press the button, cannot approve through the API, and is told never to claim a change was applied before it was confirmed. If you reload the page, cards that are still valid come back. They also appear at the top of **System › Settings › API & AI agents** under "Waiting for your confirmation".

![Confirmation card showing the balance change, the countdown and the Confirm and Reject buttons](https://nexcmp.com/docs/images/configure-with-ai/ai-chat-in-admin-02-confirm.webp)

## Secrets {#secrets}

Passwords and API keys must not go through the chat text. Use the **Secret** field (lock icon) next to the input:

1. Click the lock icon and enter a **name** (letters, digits and underscore, for example `smtp_password`) and the **value**.
2. In your message refer to the name: "use the secret smtp_password as the SMTP password".
3. The assistant only ever sees a placeholder that stands for the secret, written like this:

   ```text
   {{secret:smtp_password}}
   ```

   The panel replaces it with the real value at the moment it runs the tool. The value is not saved in the chat history and is not sent to the AI source.

If you paste something that looks like a key into the message by mistake, the panel moves it into the same protected store and masks it in the history, but treat that as a safety net, not a method. Secrets stay in the panel's memory only, for the conversation they were entered in and for up to one hour after its last message; a panel restart also clears them. Enter them again if the assistant asks.

Setting a secret also needs the `secrets:write` permission for the chat session (see below).

## Permissions of the chat

Each message runs with a temporary key that exists for the length of the answer (at most 15 minutes), works only from the panel server and can only be used through the confirmation cards. Its scopes are the ones ticked in **System › Settings › AI accounts › Chat session permissions**. `admin:read` is always on. All scopes except `secrets:write` are on by default; tick `secrets:write` if you want the assistant to be able to set passwords and keys (through the Secret field). On a demo panel the chat is read-only.

## Daily spending cap

AI Chat adds up the estimated cost of answers from API sources. The default cap is **5 USD per administrator per day**. Set another amount (0 means no limit) under **AI accounts › Defaults for AI Chat**. The page shows "used today". When the cap is reached the chat refuses new messages (`daily_cap`) until the next day or until you raise the cap. Sources that are AI CLI subscriptions are not counted, because they are billed by your subscription.

## Verify

1. In **AI accounts** click **Test** on the source. It answers with the model name and the time in milliseconds.
2. In AI Chat ask "Check my setup progress". The answer lists the steps from the [checklist](https://nexcmp.com/docs/configure-with-ai/setup-checklist/) and a `setup_checklist` tool card appears.
3. Ask for a small change, for example "Set the brand name to Example Cloud". A confirmation card appears; press **Confirm** and check the Branding page.
4. **API & AI agents › Activity** lists the calls with the channel `chat`.

## Limits & notes

- The assistant has no shell and cannot read files on the server. It only calls the [admin tools](https://nexcmp.com/docs/configure-with-ai/mcp-admin/#tools).
- Changes that keys can never make ([list](https://nexcmp.com/docs/configure-with-ai/admin-api-keys/#what-a-key-can-never-do)) cannot be made from AI Chat either.
- Check the model's work. A confirmation card shows exactly what will be sent; read it, especially prices and amounts.
- API answers are billed by the AI vendor. The cap is an estimate; set a spending limit at the vendor too.
- A CLI answer stops after 5 minutes.

## Troubleshooting

| Symptom | Cause | Fix |
|---|---|---|
| "Today's AI spending cap is reached" (`daily_cap`) | You used the daily cap | Raise it in AI accounts, or wait for tomorrow. |
| "Another answer is still running - wait or press Stop" (`busy`) | One answer at a time per administrator | Press **Stop** or wait. |
| The source does not appear in the selector | It is not connected, or (Claude CLI) the "I understand" switch is off | Connect it in AI accounts. |
| "that does not look like an API key" | The pasted key has spaces or is too long | Paste only the key. |
| Test fails | Wrong key, no credit, or the vendor is down | Check the key and billing at the vendor. |
| The assistant says it cannot do something | The chat session lacks the scope, or the action is closed to AI | Tick the scope in AI accounts or do it in the admin. |
| A card says it expired | More than 5 minutes passed | Ask the assistant to propose the change again. |
| CLI source reports "usage limit" or "not logged in" | Your subscription limit or session | Sign in again or wait; see [AI accounts and subscriptions](https://nexcmp.com/docs/configure-with-ai/ai-accounts-and-subscriptions/). |