diff --git a/archon-ui-main/src/components/settings/RAGSettings.tsx b/archon-ui-main/src/components/settings/RAGSettings.tsx
index 3dfcd220f9..ee4540a3f3 100644
--- a/archon-ui-main/src/components/settings/RAGSettings.tsx
+++ b/archon-ui-main/src/components/settings/RAGSettings.tsx
@@ -17,6 +17,7 @@ interface RAGSettingsProps {
     USE_RERANKING: boolean;
     LLM_PROVIDER?: string;
     LLM_BASE_URL?: string;
+    OPENAI_BASE_URL?: string;
     EMBEDDING_MODEL?: string;
     // Crawling Performance Settings
     CRAWL_BATCH_SIZE?: number;
@@ -85,6 +86,20 @@ export const RAGSettings = ({
               />
             </div>
           )}
+          {ragSettings.LLM_PROVIDER === 'openai' && (
+            <div>
+              <Input
+                label="OpenAI Base URL (optional)"
+                value={ragSettings.OPENAI_BASE_URL || ''}
+                onChange={e => setRagSettings({
+                  ...ragSettings,
+                  OPENAI_BASE_URL: e.target.value
+                })}
+                placeholder="https://api.openai.com/v1"
+                accentColor="green"
+              />
+            </div>
+          )}
           <div className="flex items-end">
             <Button 
               variant="outline" 
diff --git a/docs/docs/api-reference.mdx b/docs/docs/api-reference.mdx
index 5385830e5d..8cc0d40a20 100644
--- a/docs/docs/api-reference.mdx
+++ b/docs/docs/api-reference.mdx
@@ -1466,6 +1466,7 @@ Retrieve all RAG configuration settings including LLM provider options.
     "USE_RERANKING": "true",
     "LLM_PROVIDER": "openai",
     "LLM_BASE_URL": null,
+    "OPENAI_BASE_URL": "http://localhost:8000/v1",
     "EMBEDDING_MODEL": null
   }
 }
@@ -1475,11 +1476,11 @@ Retrieve all RAG configuration settings including LLM provider options.
 
 | Setting | Type | Description |
 |---------|------|-------------|
-| `LLM_PROVIDER` | string | Provider choice: `openai`, `ollama`, `google` |
-| `LLM_BASE_URL` | string | Custom base URL (required for Ollama) |
-| `EMBEDDING_MODEL` | string | Override default embedding model |
-| `MODEL_CHOICE` | string | Chat model for summaries and contextual embeddings |
-
+| `LLM_PROVIDER`     | string | Provider choice: `openai`, `ollama`, `google` |
+| `LLM_BASE_URL`     | string | Custom base URL (required for Ollama) |
+| `OPENAI_BASE_URL`  | string | Custom OpenAI endpoint for proxies (LiteLLM, Azure OpenAI) — applies system-wide |
+| `EMBEDDING_MODEL`  | string | Override default embedding model |
+| `MODEL_CHOICE`     | string | Chat model for summaries and contextual embeddings |
 ## 💬 Agent Chat API
 
 <Admonition type="warning" title="Integration Note">
diff --git a/docs/docs/configuration.mdx b/docs/docs/configuration.mdx
index e4fc371ade..c7d93fcd38 100644
--- a/docs/docs/configuration.mdx
+++ b/docs/docs/configuration.mdx
@@ -141,10 +141,57 @@ Configure in **Settings → RAG Settings → LLM Provider**
 
 <Admonition type="tip" title="Provider Setup">
 - **API Keys**: Add provider-specific keys in Settings → API Keys
+- **Custom Base URLs**: Configure custom endpoints for OpenAI-compatible proxies
 - **Ollama**: Requires local installation and custom base URL
 - **Models**: Each provider has different model naming conventions
 </Admonition>
 
+#### OpenAI Base URL Configuration
+
+For advanced use cases, you can configure a custom OpenAI base URL to route **all OpenAI API requests** through:
+- **LiteLLM proxy** for multi-provider access
+- **Azure OpenAI** endpoints
+- **Corporate proxies** or custom gateways
+- **Local OpenAI-compatible servers**
+
+<Admonition type="info" title="Centralized Configuration">
+The `OPENAI_BASE_URL` setting applies consistently across **all services**:
+- PydanticAI agents (RAG, document processing, task management)
+- LLM provider service (embeddings, contextual processing)
+- Background tasks and batch operations
+
+This ensures consistent proxy routing for all OpenAI API usage throughout the system.
+</Admonition>
+
+<Tabs>
+<TabItem value="ui" label="UI Configuration" default>
+
+1. Navigate to **Settings → RAG Settings**
+2. Select **OpenAI** as your LLM Provider
+3. Enter your custom **OpenAI Base URL** (optional)
+4. Examples:
+   - LiteLLM: `http://localhost:8000/v1`
+   - Azure OpenAI: `https://your-resource.openai.azure.com/openai/deployments/your-deployment`
+   - Custom proxy: `https://api.yourcompany.com/openai/v1`
+
+</TabItem>
+<TabItem value="env" label="Environment Variables">
+
+```bash
+# Optional - Custom OpenAI endpoint
+OPENAI_BASE_URL=http://localhost:8000/v1
+
+# Required when using custom base URL
+OPENAI_API_KEY=your-api-key-here
+```
+
+<Admonition type="warning" title="Security Requirements">
+When using a custom `OPENAI_BASE_URL`, an API key must be provided for security reasons. This prevents accidental traffic leaks to public endpoints when a proxy is explicitly configured.
+</Admonition>
+
+</TabItem>
+</Tabs>
+
 ### Socket.IO Configuration
 
 Archon uses Socket.IO for all real-time features. The default configuration works out of the box:
diff --git a/docs/docs/rag.mdx b/docs/docs/rag.mdx
index a77167c12e..bb7db572e2 100644
--- a/docs/docs/rag.mdx
+++ b/docs/docs/rag.mdx
@@ -303,10 +303,66 @@ USE_RERANKING=true
 LLM_PROVIDER=openai
 MODEL_CHOICE=gpt-4o-mini
 EMBEDDING_MODEL=text-embedding-3-small
-# Pros: Best accuracy, reliable API
+
+# Optional: Custom OpenAI endpoint
+OPENAI_BASE_URL=https://api.openai.com/v1
+
+# Pros: Best accuracy, reliable API, proxy support
 # Cons: Cost per query
 ```
 
+#### OpenAI Proxy Configuration
+
+Configure custom endpoints for advanced routing scenarios. These settings apply to **all OpenAI API usage** including RAG queries, embeddings, and background processing:
+
+<Tabs>
+<TabItem value="litellm" label="LiteLLM Proxy" default>
+
+```bash
+# LiteLLM proxy for multi-provider access
+LLM_PROVIDER=openai
+OPENAI_BASE_URL=http://localhost:8000/v1
+MODEL_CHOICE=gpt-4o-mini  # Route through LiteLLM
+OPENAI_API_KEY=your-litellm-key
+
+# Benefits:
+# - Multi-provider routing (OpenAI, Anthropic, etc.)
+# - Cost tracking and rate limiting
+# - Centralized API management
+```
+
+**LiteLLM Setup:**
+```bash
+# Install LiteLLM
+pip install litellm[proxy]
+
+# Start proxy server
+litellm --port 8000 --config litellm_config.yaml
+```
+
+</TabItem>
+<TabItem value="azure" label="Azure OpenAI">
+
+
+</TabItem>
+<TabItem value="corporate" label="Corporate Proxy">
+
+```bash
+# Corporate gateway/proxy
+LLM_PROVIDER=openai
+OPENAI_BASE_URL=https://api.yourcompany.com/openai/v1
+MODEL_CHOICE=gpt-4o-mini
+OPENAI_API_KEY=your-internal-key
+
+# Benefits:
+# - Centralized billing and monitoring
+# - Security and compliance enforcement
+# - Custom authentication and authorization
+```
+
+</TabItem>
+</Tabs>
+
 ### Google Gemini
 ```bash
 LLM_PROVIDER=google
@@ -368,6 +424,13 @@ EMBEDDING_MODEL=nomic-embed-text
 3. Use caching more aggressively
 4. Consider switching to local models (Ollama)
 
+### API Key Management
+- **Separate Keys**: Use different API keys for proxy vs direct OpenAI access
+- **Key Rotation**: Regularly rotate API keys, especially for proxy endpoints
+- **Environment Variables**: Never hardcode keys in configuration files
+- **Least Privilege**: Proxy keys should have minimal required permissions
+- **No Secrets in Logs**: Disable logging of Authorization headers and redact API keys in all logs.
+
 ## 🎯 Best Practices
 
 ### Content Optimization
diff --git a/python/src/agents/agent_provider_config.py b/python/src/agents/agent_provider_config.py
new file mode 100644
index 0000000000..fe7311bac8
--- /dev/null
+++ b/python/src/agents/agent_provider_config.py
@@ -0,0 +1,262 @@
+"""
+Agent Provider Configuration
+
+Handles OpenAI provider configuration for PydanticAI agents.
+Enables custom base_url configuration for OpenAI-compatible endpoints.
+"""
+
+import ipaddress
+import logging
+import os
+from urllib.parse import urlparse
+
+from pydantic_ai.models.openai import OpenAIChatModel
+from pydantic_ai.providers.openai import OpenAIProvider
+
+logger = logging.getLogger(__name__)
+
+
+def _validate_base_url(base_url: str) -> str:
+    """
+    Validate and normalize a base URL.
+
+    Args:
+        base_url: The base URL to validate
+
+    Returns:
+        The validated and normalized base URL
+
+    Raises:
+        ValueError: If the URL is invalid or unsafe
+    """
+    if not base_url or not base_url.strip():
+        raise ValueError("Base URL cannot be empty")
+
+    # Normalize the URL (trim whitespace)
+    url = base_url.strip()
+
+    # Parse the URL to validate its structure
+    try:
+        parsed = urlparse(url)
+    except Exception as e:
+        raise ValueError(f"Invalid URL format: {e}") from e
+
+    # Ensure it has a valid scheme
+    if not parsed.scheme:
+        raise ValueError("Base URL must include a scheme (http:// or https://)")
+
+    if parsed.scheme not in ['http', 'https']:
+        raise ValueError("Base URL must use http:// or https:// scheme")
+
+    # Ensure it has a valid hostname
+    if not parsed.hostname:
+        raise ValueError("Base URL must include a valid hostname")
+
+    # Disallow embedding credentials in the URL
+    if parsed.username or parsed.password:
+        raise ValueError("Base URL must not embed credentials (userinfo)")
+
+    # Log security consideration for non-HTTPS URLs
+    is_private = False
+    try:
+        host_ip = ipaddress.ip_address(parsed.hostname)
+        is_private = host_ip.is_loopback or host_ip.is_private
+    except ValueError:
+        # Not an IP literal; accept common local hostnames
+        is_private = parsed.hostname in ('localhost', 'host.docker.internal')
+    if parsed.scheme == 'http' and not is_private:
+        logger.warning(f"Using non-HTTPS URL for OpenAI base URL: {url}. Consider using HTTPS for production.")
+
+    return url
+
+
+async def get_configured_openai_model(model_name: str) -> OpenAIChatModel | str:
+    """
+    Get a configured OpenAI model for PydanticAI agents.
+
+    If OPENAI_BASE_URL is configured in the system, returns an OpenAIChatModel
+    with a custom OpenAIProvider. Otherwise, returns the standard model string
+    format that PydanticAI handles automatically.
+
+    Args:
+        model_name: The model name (e.g., "gpt-4o", "gpt-4o-mini")
+
+    Returns:
+        Either an OpenAIChatModel with custom provider or a model string
+    """
+    try:
+        # Try to get base URL from credential service
+        base_url = await _get_openai_base_url()
+
+        # Validate and normalize base URL
+        if base_url:
+            try:
+                base_url = _validate_base_url(base_url)
+            except ValueError as e:
+                logger.error("Invalid OPENAI_BASE_URL configuration", exc_info=True)
+                # Don't fall back silently - re-raise the error to fail fast
+                raise ValueError(f"Invalid OPENAI_BASE_URL configuration: {e}") from e
+
+        if base_url:
+            # Get API key
+            api_key = await _get_openai_api_key()
+            if not api_key:
+                # Fail fast when base URL is configured but API key is missing
+                # This prevents traffic from leaking to public endpoints when a proxy was explicitly configured
+                raise ValueError(
+                    f"OPENAI_BASE_URL is configured ({base_url}) but no OpenAI API key is available. "
+                    "When using a custom base URL, an API key must be provided for security reasons."
+                )
+
+            # Create custom provider with base_url
+            provider = OpenAIProvider(
+                base_url=base_url,
+                api_key=api_key
+            )
+
+            logger.info(f"Creating OpenAI model {model_name} with custom base URL: {base_url}")
+            return OpenAIChatModel(model_name, provider=provider)
+        else:
+            # No custom base URL, use standard string format
+            logger.debug(f"Using default OpenAI configuration for model: {model_name}")
+            return f"openai:{model_name}"
+
+    except Exception:
+        logger.error("Error configuring OpenAI model", exc_info=True)
+        # If a custom base URL was configured, fail fast to avoid leaking traffic.
+        if "base_url" in locals() and base_url:
+            raise
+        # Otherwise, fall back to the default OpenAI configuration.
+        return f"openai:{model_name}"
+
+async def _get_openai_base_url() -> str | None:
+    """Get OpenAI base URL from credential service."""
+    try:
+        # Import here to avoid circular imports
+        from ..server.services.credential_service import credential_service
+
+        # Prefer direct credential lookup (handles decryption and consistent typing)
+        base_url = await credential_service.get_credential("OPENAI_BASE_URL", decrypt=True)
+        if base_url:
+            logger.debug("Found OPENAI_BASE_URL in credential service")
+            return str(base_url)
+        # Check environment variable as fallback
+        env_base_url = os.getenv("OPENAI_BASE_URL")
+        if env_base_url:
+            logger.debug(f"Found OPENAI_BASE_URL in environment: {env_base_url}")
+            return env_base_url
+        return None
+
+    except Exception as e:
+        logger.debug(f"Could not get OPENAI_BASE_URL from settings: {e}")
+        # Try environment variable as fallback
+        return os.getenv("OPENAI_BASE_URL")
+
+
+async def _get_openai_api_key() -> str | None:
+    """Get OpenAI API key from credential service."""
+    try:
+        # Import here to avoid circular imports
+        from ..server.services.credential_service import credential_service
+
+        # Try to get from credential service first
+        api_key = await credential_service.get_credential("OPENAI_API_KEY", decrypt=True)
+        if api_key:
+            logger.debug("Found OPENAI_API_KEY in credential service")
+            return api_key
+
+        # Fallback to environment variable
+        env_api_key = os.getenv("OPENAI_API_KEY")
+        if env_api_key:
+            logger.debug("Found OPENAI_API_KEY in environment")
+            return env_api_key
+
+        return None
+
+    except Exception as e:
+        logger.debug(f"Could not get OPENAI_API_KEY from settings: {e}")
+        # Try environment variable as fallback
+        return os.getenv("OPENAI_API_KEY")
+
+
+async def get_openai_client_config() -> dict[str, str | None]:
+    """
+    Get OpenAI client configuration for creating openai.AsyncOpenAI instances.
+
+    This provides centralized configuration that honors OPENAI_BASE_URL settings
+    and applies the same validation and security checks as the PydanticAI agents.
+
+    Returns:
+        Dict with 'api_key' and 'base_url' keys. Both may be None if not configured.
+
+    Raises:
+        ValueError: If OPENAI_BASE_URL is configured but invalid or missing API key
+    """
+    try:
+        # Get base URL using same logic as get_configured_openai_model
+        base_url = await _get_openai_base_url()
+
+        # Validate and normalize base URL
+        if base_url:
+            try:
+                base_url = _validate_base_url(base_url)
+            except ValueError as e:
+                logger.error("Invalid OPENAI_BASE_URL configuration", exc_info=True)
+                # Don't fall back silently - re-raise the error to fail fast
+                raise ValueError(f"Invalid OPENAI_BASE_URL configuration: {e}") from e
+
+        # Get API key
+        api_key = await _get_openai_api_key()
+
+        # Apply same security check as in get_configured_openai_model
+        if base_url and not api_key:
+            # Fail fast when base URL is configured but API key is missing
+            # This prevents traffic from leaking to public endpoints when a proxy was explicitly configured
+            raise ValueError(
+                f"OPENAI_BASE_URL is configured ({base_url}) but no OpenAI API key is available. "
+                "When using a custom base URL, an API key must be provided for security reasons."
+            )
+
+        logger.debug(f"OpenAI client config: base_url={base_url}, has_api_key={bool(api_key)}")
+
+        return {
+            "api_key": api_key,
+            "base_url": base_url,
+        }
+
+    except Exception:
+        logger.error("Error getting OpenAI client configuration", exc_info=True)
+        # If a custom base URL was configured, fail fast to avoid leaking traffic.
+        base_url = None
+        try:
+            base_url = await _get_openai_base_url()
+        except Exception:
+            pass
+
+        if base_url:
+            raise
+
+        # Otherwise, return default configuration
+        return {
+            "api_key": None,
+            "base_url": None,
+        }
+
+
+def get_configured_openai_model_sync(model_name: str) -> str:
+    """
+    Synchronous version that returns model string format.
+
+    Since we can't easily call async functions from sync contexts,
+    this returns the standard model string format and relies on
+    PydanticAI's automatic configuration.
+
+    Args:
+        model_name: The model name (e.g., "gpt-4o", "gpt-4o-mini")
+
+    Returns:
+        Model string in "openai:model" format
+    """
+    # For synchronous contexts, we use the standard format
+    # PydanticAI will handle OpenAI configuration automatically
+    return f"openai:{model_name}"
diff --git a/python/src/agents/base_agent.py b/python/src/agents/base_agent.py
index 7ea03c031f..34cf9db0ab 100644
--- a/python/src/agents/base_agent.py
+++ b/python/src/agents/base_agent.py
@@ -17,6 +17,16 @@
 logger = logging.getLogger(__name__)
 
 
+class RateLimitExceededError(Exception):
+    """Raised when rate limit is exceeded after all retries."""
+    pass
+
+
+class AgentExecutionError(Exception):
+    """Raised when agent execution fails."""
+    pass
+
+
 @dataclass
 class ArchonDependencies:
     """Base dependencies for all Archon agents."""
@@ -89,9 +99,9 @@ async def execute_with_rate_limit(self, func, *args, progress_callback=None, **k
                                 "step": "ai_generation",
                                 "log": f"❌ Rate limit exceeded after {self.max_retries} retries",
                             })
-                        raise Exception(
+                        raise RateLimitExceededError(
                             f"Rate limit exceeded after {self.max_retries} retries: {full_error}"
-                        )
+                        ) from None
 
                     # Extract wait time from error message if available
                     wait_time = self._extract_wait_time(full_error)
@@ -133,7 +143,7 @@ def _extract_wait_time(self, error_message: str) -> float | None:
             match = re.search(r"try again in (\d+(?:\.\d+)?)s", error_message)
             if match:
                 return float(match.group(1))
-        except:
+        except Exception:
             pass
         return None
 
@@ -156,12 +166,14 @@ def __init__(
         name: str = None,
         retries: int = 3,
         enable_rate_limiting: bool = True,
+        use_custom_provider: bool = True,
         **agent_kwargs,
     ):
         self.model = model
         self.name = name or self.__class__.__name__
         self.retries = retries
         self.enable_rate_limiting = enable_rate_limiting
+        self.use_custom_provider = use_custom_provider
 
         # Initialize rate limiting
         if self.enable_rate_limiting:
@@ -169,17 +181,58 @@ def __init__(
         else:
             self.rate_limiter = None
 
-        # Initialize the PydanticAI agent
-        self._agent = self._create_agent(**agent_kwargs)
-
         # Setup logging
         self.logger = logging.getLogger(f"agents.{self.name}")
 
+        # Initialize the PydanticAI agent (this may be async now)
+        self._agent = None
+        self._agent_kwargs = agent_kwargs
+        self._init_lock = asyncio.Lock()  # Thread-safe initialization lock
+
     @abstractmethod
-    def _create_agent(self, **kwargs) -> Agent:
+    async def _create_agent(self, **kwargs) -> Agent:
         """Create and configure the PydanticAI agent. Must be implemented by subclasses."""
         pass
 
+    async def _ensure_agent_initialized(self):
+        """Ensure the PydanticAI agent is initialized in a thread-safe manner."""
+        if self._agent is None:
+            async with self._init_lock:
+                # Double-check after acquiring lock to prevent double initialization
+                if self._agent is None:
+                    self._agent = await self._create_agent(**self._agent_kwargs)
+
+    async def _get_configured_model(self):
+        """Get the configured model for this agent."""
+        if self.use_custom_provider and self.model.startswith("openai:"):
+            # Extract model name from "openai:model" format using removeprefix
+            model_name = self.model.removeprefix("openai:")
+
+            # Guard against empty model names
+            if not model_name:
+                raise ValueError(f"Empty model name after removing 'openai:' prefix from '{self.model}'")
+
+            try:
+                from .agent_provider_config import get_configured_openai_model
+                return await get_configured_openai_model(model_name)
+            except ValueError:
+                # Misconfiguration of OPENAI_BASE_URL or missing API key: fail fast to avoid leaking traffic.
+                self.logger.error(
+                    "Custom OpenAI provider misconfigured; refusing to fall back to default",
+                    exc_info=True
+                )
+                raise
+            except Exception:
+                # Non-configuration error: log and fall back.
+                self.logger.warning(
+                    "Failed to get custom OpenAI provider, falling back to default",
+                    exc_info=True
+                )
+                return self.model
+        else:
+            # Use the model string as-is
+            return self.model
+
     @abstractmethod
     def get_system_prompt(self) -> str:
         """Get the system prompt for this agent. Must be implemented by subclasses."""
@@ -208,6 +261,9 @@ async def run(self, user_prompt: str, deps: DepsT) -> OutputT:
     async def _run_agent(self, user_prompt: str, deps: DepsT) -> OutputT:
         """Internal method to run the agent."""
         try:
+            # Ensure agent is initialized
+            await self._ensure_agent_initialized()
+
             # Add timeout to prevent hanging
             result = await asyncio.wait_for(
                 self._agent.run(user_prompt, deps=deps),
@@ -216,14 +272,14 @@ async def _run_agent(self, user_prompt: str, deps: DepsT) -> OutputT:
             self.logger.info(f"Agent {self.name} completed successfully")
             # PydanticAI returns a RunResult with data attribute
             return result.data
-        except asyncio.TimeoutError:
+        except TimeoutError:
             self.logger.error(f"Agent {self.name} timed out after 120 seconds")
-            raise Exception(f"Agent {self.name} operation timed out - taking too long to respond")
+            raise AgentExecutionError(f"Agent {self.name} operation timed out - taking too long to respond") from None
         except Exception as e:
-            self.logger.error(f"Agent {self.name} failed: {str(e)}")
-            raise
+            self.logger.error("Agent %s failed", self.name, exc_info=True)
+            raise AgentExecutionError(f"Agent {self.name} failed") from e
 
-    def run_stream(self, user_prompt: str, deps: DepsT):
+    async def run_stream(self, user_prompt: str, deps: DepsT):
         """
         Run the agent with streaming output.
 
@@ -236,6 +292,8 @@ def run_stream(self, user_prompt: str, deps: DepsT):
         """
         # Note: Rate limiting not supported for streaming to avoid complexity
         # The async context manager pattern doesn't work well with rate limiting
+        await self._ensure_agent_initialized()
+
         self.logger.info(f"Starting streaming for agent {self.name}")
         # run_stream returns an async context manager directly, not a coroutine
         return self._agent.run_stream(user_prompt, deps=deps)
@@ -262,4 +320,6 @@ def add_system_prompt_function(self, func):
     @property
     def agent(self) -> Agent:
         """Get the underlying PydanticAI agent instance."""
+        if self._agent is None:
+            raise RuntimeError("Agent not initialized; call await _ensure_agent_initialized() first")
         return self._agent
diff --git a/python/src/agents/document_agent.py b/python/src/agents/document_agent.py
index 9e9c5fbfc7..1d2e9d19c3 100644
--- a/python/src/agents/document_agent.py
+++ b/python/src/agents/document_agent.py
@@ -70,11 +70,14 @@ def __init__(self, model: str = None, **kwargs):
             model=model, name="DocumentAgent", retries=3, enable_rate_limiting=True, **kwargs
         )
 
-    def _create_agent(self, **kwargs) -> Agent:
+    async def _create_agent(self, **kwargs) -> Agent:
         """Create the PydanticAI agent with tools and prompts."""
+        
+        # Get the configured model (may be custom provider or default)
+        configured_model = await self._get_configured_model()
 
         agent = Agent(
-            model=self.model,
+            model=configured_model,
             deps_type=DocumentDependencies,
             result_type=DocumentOperation,
             system_prompt="""You are a Document Management Assistant that helps users create, update, and modify project documents through conversation.
diff --git a/python/src/agents/rag_agent.py b/python/src/agents/rag_agent.py
index 3c1fac0ab6..2d6c6e2727 100644
--- a/python/src/agents/rag_agent.py
+++ b/python/src/agents/rag_agent.py
@@ -68,11 +68,14 @@ def __init__(self, model: str = None, **kwargs):
             model=model, name="RagAgent", retries=3, enable_rate_limiting=True, **kwargs
         )
 
-    def _create_agent(self, **kwargs) -> Agent:
+    async def _create_agent(self, **kwargs) -> Agent:
         """Create the PydanticAI agent with tools and prompts."""
+        
+        # Get the configured model (may be custom provider or default)
+        configured_model = await self._get_configured_model()
 
         agent = Agent(
-            model=self.model,
+            model=configured_model,
             deps_type=RagDependencies,
             system_prompt="""You are a RAG (Retrieval-Augmented Generation) Assistant that helps users search and understand documentation through conversation.
 
diff --git a/python/src/agents/server.py b/python/src/agents/server.py
index be665836b3..77fd5d9e97 100644
--- a/python/src/agents/server.py
+++ b/python/src/agents/server.py
@@ -251,7 +251,8 @@ async def generate() -> AsyncGenerator[str, None]:
 
             # Use PydanticAI's run_stream method
             # run_stream returns an async context manager directly
-            async with agent.run_stream(request.prompt, deps) as stream:
+            stream_cm = await agent.run_stream(request.prompt, deps)
+            async with stream_cm as stream:
                 # Stream text chunks as they arrive
                 async for chunk in stream.stream_text():
                     event_data = json.dumps({"type": "stream_chunk", "content": chunk})
diff --git a/python/src/server/services/credential_service.py b/python/src/server/services/credential_service.py
index 017c3b2af1..479ab8621e 100644
--- a/python/src/server/services/credential_service.py
+++ b/python/src/server/services/credential_service.py
@@ -458,6 +458,9 @@ def _get_provider_base_url(self, provider: str, rag_settings: dict) -> str | Non
             return rag_settings.get("LLM_BASE_URL", "http://localhost:11434/v1")
         elif provider == "google":
             return "https://generativelanguage.googleapis.com/v1beta/openai/"
+        elif provider == "openai":
+            # Allow custom OpenAI-compatible endpoint
+            return rag_settings.get("OPENAI_BASE_URL")
         return None  # Use default for OpenAI
 
     async def set_active_provider(self, provider: str, service_type: str = "llm") -> bool:
diff --git a/python/src/server/services/llm_provider_service.py b/python/src/server/services/llm_provider_service.py
index d7c834f9f2..fe55e1ca44 100644
--- a/python/src/server/services/llm_provider_service.py
+++ b/python/src/server/services/llm_provider_service.py
@@ -5,6 +5,7 @@
 Supports OpenAI, Ollama, and Google Gemini.
 """
 
+import os
 import time
 from contextlib import asynccontextmanager
 from typing import Any
@@ -94,17 +95,45 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
         logger.info(f"Creating LLM client for provider: {provider_name}")
 
         if provider_name == "openai":
-            if not api_key:
+            # Use centralized OpenAI configuration that honors OPENAI_BASE_URL
+            from ...agents.agent_provider_config import get_openai_client_config
+
+            try:
+                openai_config = await get_openai_client_config()
+                config_api_key = openai_config["api_key"]
+                config_base_url = openai_config["base_url"]
+            except Exception as e:
+                logger.error("Failed to get centralized OpenAI configuration", exc_info=True)
+                raise ValueError("OpenAI configuration error") from e
+            # Use centralized API key if available, fall back to provider-specific key
+            final_api_key = config_api_key or api_key
+            if not final_api_key:
                 raise ValueError("OpenAI API key not found")
 
-            client = openai.AsyncOpenAI(api_key=api_key)
-            logger.info("OpenAI client created successfully")
+            # Use centralized base URL if configured, otherwise use provider-specific base URL
+            final_base_url = config_base_url or base_url
+
+            # Create client with centralized configuration
+            client_kwargs = {
+                "api_key": final_api_key,
+                "timeout": float(os.getenv("OPENAI_TIMEOUT_SECONDS", "60")),
+                "max_retries": int(os.getenv("OPENAI_MAX_RETRIES", "5")),
+            }
+            if final_base_url:
+                client_kwargs["base_url"] = final_base_url
+                logger.info(f"OpenAI client created with custom base URL: {final_base_url}")
+            else:
+                logger.info("OpenAI client created with default URL")
+
+            client = openai.AsyncOpenAI(**client_kwargs)
 
         elif provider_name == "ollama":
             # Ollama requires an API key in the client but doesn't actually use it
             client = openai.AsyncOpenAI(
                 api_key="ollama",  # Required but unused by Ollama
                 base_url=base_url or "http://localhost:11434/v1",
+                timeout=float(os.getenv("OPENAI_TIMEOUT_SECONDS", "60")),
+                max_retries=int(os.getenv("OPENAI_MAX_RETRIES", "5")),
             )
             logger.info(f"Ollama client created successfully with base URL: {base_url}")
 
@@ -115,6 +144,8 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
             client = openai.AsyncOpenAI(
                 api_key=api_key,
                 base_url=base_url or "https://generativelanguage.googleapis.com/v1beta/openai/",
+                timeout=float(os.getenv("OPENAI_TIMEOUT_SECONDS", "60")),
+                max_retries=int(os.getenv("OPENAI_MAX_RETRIES", "5")),
             )
             logger.info("Google Gemini client created successfully")
 
@@ -123,9 +154,11 @@ async def get_llm_client(provider: str | None = None, use_embedding_provider: bo
 
         yield client
 
-    except Exception as e:
+    except Exception:
         logger.error(
-            f"Error creating LLM client for provider {provider_name if 'provider_name' in locals() else 'unknown'}: {e}"
+            "Error creating LLM client for provider %s",
+            provider_name if 'provider_name' in locals() else 'unknown',
+            exc_info=True,
         )
         raise
     finally:
diff --git a/python/src/server/services/storage/code_storage_service.py b/python/src/server/services/storage/code_storage_service.py
index cacc7d7d12..f2d52a92e5 100644
--- a/python/src/server/services/storage/code_storage_service.py
+++ b/python/src/server/services/storage/code_storage_service.py
@@ -541,27 +541,55 @@ def generate_code_example_summary(
 
             import openai
 
+            # Get API key using proper credential service API
             api_key = os.getenv("OPENAI_API_KEY")
-            if not api_key:
-                # Try to get from credential service with direct fallback
-                from ..credential_service import credential_service
+            base_url = os.getenv("OPENAI_BASE_URL")  # Add environment variable fallback
 
-                if (
-                    credential_service._cache_initialized
-                    and "OPENAI_API_KEY" in credential_service._cache
-                ):
-                    cached_key = credential_service._cache["OPENAI_API_KEY"]
-                    if isinstance(cached_key, dict) and cached_key.get("is_encrypted"):
-                        api_key = credential_service._decrypt_value(cached_key["encrypted_value"])
-                    else:
-                        api_key = cached_key
-                else:
-                    api_key = os.getenv("OPENAI_API_KEY", "")
+            # Try to get from credential service using proper async API
+            # Note: This is a sync context, so we'll try the sync fallback first
+            from ..credential_service import credential_service
+
+            try:
+                # Try to get API key from credential service if not in env
+                if not api_key:
+                    # In sync context, we can only access already-cached credentials
+                    if credential_service._cache_initialized and "OPENAI_API_KEY" in credential_service._cache:
+                        cached_key = credential_service._cache["OPENAI_API_KEY"]
+                        if isinstance(cached_key, dict) and cached_key.get("is_encrypted"):
+                            try:
+                                api_key = credential_service._decrypt_value(cached_key["encrypted_value"])
+                            except Exception as e:
+                                search_logger.debug(f"Failed to decrypt API key from cache: {e}")
+                        else:
+                            api_key = cached_key
+
+                # Try to get base URL from RAG settings cache if not in env
+                # This is still accessing cache but with better error handling
+                if not base_url and hasattr(credential_service, '_rag_settings_cache') and credential_service._rag_settings_cache:
+                    base_url = credential_service._rag_settings_cache.get("OPENAI_BASE_URL")
+
+            except Exception as e:
+                search_logger.debug(f"Failed to retrieve credentials from service: {e}")
+
+            # Normalize base URL (trim whitespace, convert empty strings to None)
+            if base_url:
+                base_url = base_url.strip()
+                if not base_url:
+                    base_url = None
+
+            # Final fallback for API key
+            if not api_key:
+                api_key = os.getenv("OPENAI_API_KEY", "")
 
             if not api_key:
                 raise ValueError("No OpenAI API key available")
 
-            client = openai.OpenAI(api_key=api_key)
+            # Create client with optional base_url for custom OpenAI-compatible endpoints
+            client_kwargs = {"api_key": api_key}
+            if base_url:
+                client_kwargs["base_url"] = base_url
+
+            client = openai.OpenAI(**client_kwargs)
         except Exception as e:
             search_logger.error(
                 f"Failed to create LLM client fallback: {e} - returning default values"