diff --git a/app/MindWork AI Studio/Settings/Provider.cs b/app/MindWork AI Studio/Settings/Provider.cs
index d6677f3c..fdf63a34 100644
--- a/app/MindWork AI Studio/Settings/Provider.cs	
+++ b/app/MindWork AI Studio/Settings/Provider.cs	
@@ -36,7 +36,7 @@ public sealed record Provider(
     HFInferenceProvider HFInferenceProvider = HFInferenceProvider.NONE,
     string AdditionalJsonApiParameters = "",
     ProviderCapabilityOverrides? CapabilityOverrides = null,
-    bool AllowUserProvidedAPIKey = false) : ConfigurationBaseObject, ISecretId
+    bool AllowUserProvidedAPIKey = false) : ConfigurationBaseObject, ISecretId, IUserProvidedAPIKey
 {
     private static readonly ILogger<Provider> LOGGER = Program.LOGGER_FACTORY.CreateLogger<Provider>();
     
diff --git a/app/MindWork AI Studio/Tools/PluginSystem/IUserProvidedAPIKey.cs b/app/MindWork AI Studio/Tools/PluginSystem/IUserProvidedAPIKey.cs
new file mode 100644
index 00000000..db0cb054
--- /dev/null
+++ b/app/MindWork AI Studio/Tools/PluginSystem/IUserProvidedAPIKey.cs	
@@ -0,0 +1,15 @@
+namespace AIStudio.Tools.PluginSystem;
+
+/// <summary>
+/// Represents a configuration object whose API key is managed by the user, although the object
+/// itself is managed by a configuration plugin. Implemented by all provider kinds which support
+/// the "AllowUserProvidedAPIKey" option, i.e., LLM, embedding, and transcription providers.
+/// </summary>
+public interface IUserProvidedAPIKey
+{
+    /// <summary>
+    /// When set by a configuration plugin, the user may set their own API key for this otherwise
+    /// locked, enterprise-managed object.
+    /// </summary>
+    public bool AllowUserProvidedAPIKey { get; }
+}
\ No newline at end of file
diff --git a/app/MindWork AI Studio/Tools/PluginSystem/PluginConfigurationObject.cs b/app/MindWork AI Studio/Tools/PluginSystem/PluginConfigurationObject.cs
index 5398e133..07b4e3e8 100644
--- a/app/MindWork AI Studio/Tools/PluginSystem/PluginConfigurationObject.cs	
+++ b/app/MindWork AI Studio/Tools/PluginSystem/PluginConfigurationObject.cs	
@@ -407,7 +407,7 @@ public sealed record PluginConfigurationObject
                 else
                     LOG.LogWarning($"Failed to delete secret for removed enterprise object '{item.Name}' from the OS keyring: {deleteResult.Issue}");
             }
-            else if(item is Settings.Provider { AllowUserProvidedAPIKey: true })
+            else if(item is IUserProvidedAPIKey { AllowUserProvidedAPIKey: true })
             {
                 // The user manages their own key for this provider. Keep it in the OS keyring
                 // in case the organization's configuration comes back later, instead of forcing