Word and Excel — GPT for Work add-ins
GPT for Excel and GPT for Word (Talarian’s GPT for Work suite) are the leading Office add-ins that connect to any OpenAI-compatible endpoint. A space owner or admin configures the endpoint once in the GPT for Work dashboard — Custom API endpoints in the sidebar — and every user in the space gets the gateway models. Custom endpoints require their Business or Enterprise plan or pay-as-you-go pricing. There are two endpoint types, on separate tabs:-
Bulk models (Excel and Word) — the Chat Completions path, used by bulk
prompting and the spreadsheet functions. Add an OpenAI-compatible endpoint
(Chat Completions API) with:
- Endpoint URL:
https://api.aireserve.com— host root, no/v1(unlike most tools in these guides: GPT for Work appends the/v1/modelsand/v1/chat/completionsresource paths itself, so a/v1suffix here would double up). - API key: your
aireserve_api_…key. - Display name (optional): e.g.
AI Reserve— prefixed to model names in the model switcher (custom/by default).
/v1/modelsis the discovery call — it excludes client-exclusive models but does include consent-gated ones, so a model your org hasn’t opted into will list here and refuse at call time with the reason). - Endpoint URL:
-
Agent models (Excel only) — the agent sidebar, which drives the
workbook. Add an OpenAI-compatible endpoint (Responses API) with the
same Endpoint URL and key, plus a Model ID per entry (say
gpt-5.5orclaude-sonnet-4-6). GPT for Work requires the endpoint to serve/v1/responsesover public HTTPS and the model to have at least a 32K-token context — the gateway serves the Responses format for every model, and the flagship models all clear the context bar.
Why this just works. GPT for Work runs inside Office’s embedded browser,
so it calls the endpoint straight from the client — which is why it requires
public HTTPS and CORS support. The gateway has both (it answers cross-origin
browser requests on
/v1/models, /v1/chat/completions, and
/v1/responses), so both endpoint types validate as-is. No proxy, no relay.Excel — Office Scripts
Office Scripts can call the gateway directly withfetch
(external calls are supported
when the script runs in the Excel application). This script reads the prompt
from A1 and writes the answer to B1:
fetch is not defined at runtime — use the Power Automate path below
instead), and scripts stored on SharePoint can’t make external calls at all.
Tenant admins can also block external calls outright, so if the snippet fails
on a managed machine, ask IT before debugging.
Power Automate
For flows, skip Office Scripts and call the gateway from the flow itself — that’s Microsoft’s own guidance. Add an HTTP action:
Pull the reply out with the expression
body('HTTP')?['choices']?[0]?['message']?['content'] and hand it to any
Office connector — write it to Excel rows, draft Outlook mail, fill a Word
template. HTTP actions are
premium-class connectors in Power Automate,
so the flow owner needs a
Power Automate Premium license.
Store the key in a secured environment variable or Azure Key Vault rather
than inline.
Microsoft Copilot — the boundary
Microsoft 365 Copilot (now named simply Microsoft Copilot) cannot be pointed at a third-party endpoint. Its models are chosen, hosted, and operated by Microsoft — Azure OpenAI Service, plus Anthropic and OpenAI models under Microsoft’s subprocessor arrangements — and the product has no base-URL or API-key setting anywhere, so there is nothing to configure. A gateway can’t serve a request Copilot never sends. Microsoft’s extensibility story — custom engine agents via Copilot Studio or the Microsoft 365 Agents SDK — lets an organization bring its own agent (and behind it, its own models) into the Copilot UI. That’s a build-and-host-a-bot surface, not a paste-a-key setting, and it’s out of scope for this guide.Usage from these surfaces is metered per key like any other gateway traffic. None of them carry a harness signature the gateway recognizes, so mint a dedicated key per surface (one for the GPT for Work space, one per flow) — that keeps Office spend cleanly separated in your analytics, and a leaked key stays scoped to one surface.