Prime Agent supports subscription-based providers via OAuth and API key providers via environment variables or the auth file. Models for external providers are bundled with each release. Prime Inference models refresh from its /models endpoint, with the bundled list and a validated disk cache as fallbacks. Set PI_OFFLINE=1 to skip network refreshes.
Use /login in interactive mode, then select a provider:
- ChatGPT Plus/Pro (Codex)
- Claude Pro/Max
- GitHub Copilot
- xAI Grok (eligible subscriptions)
Use /logout to clear credentials. Tokens are stored in ~/.prime/agent/auth.json and auto-refresh when expired.
- Requires ChatGPT Plus or Pro subscription
- Officially endorsed by OpenAI: Codex for OSS
Anthropic subscription auth is active for Claude Pro/Max accounts. Third-party harness usage draws from extra usage and is billed per token, not against Claude plan limits.
- Press Enter for github.com, or enter your GitHub Enterprise Server domain
- If you get "model not supported", enable it in VS Code: Copilot Chat → model selector → select model → "Enable"
Use /login and select the xAI subscription entry to open browser sign-in. Complete the authorization flow for an eligible Grok subscription. The existing xAI API-key entry still accepts a key, and XAI_API_KEY remains supported.
Both methods use provider ID xai and https://api.x.ai/v1. Subscription requests use /responses; API-key requests keep the existing /chat/completions route and model defaults. Changing authentication updates the current session without requiring model reselection.
Choose any bundled xAI tool-capable language model with /model after initial setup. The same catalog is shown for subscription and API-key login. Subscription requests preserve each model’s reasoning and input capabilities; reasoning-effort controls are limited to verified options. Access and usage limits depend on your account entitlement; listing a model does not guarantee a successful request. If a model is unavailable or authorization fails, check your plan or use an API key.
grok-code-fast-1 remains a legacy alias for grok-build-0.1, not a separate model. Image/video generators and the multi-agent model are not included because they do not support the agent’s custom function tools.
/logout removes saved xAI authentication, but does not unset XAI_API_KEY; an environment key can remain active after logout.
Use /login in interactive mode and select a provider to store an API key in auth.json, or set credentials via environment variable:
export ANTHROPIC_API_KEY=sk-ant-...
prime-agent| Provider | Environment Variable | auth.json key |
|---|---|---|
| Anthropic | ANTHROPIC_API_KEY |
anthropic |
| Azure OpenAI Responses | AZURE_OPENAI_API_KEY |
azure-openai-responses |
| OpenAI | OPENAI_API_KEY |
openai |
| Prime Inference | PRIME_API_KEY |
prime-inference |
| DeepSeek | DEEPSEEK_API_KEY |
deepseek |
| Google Gemini | GEMINI_API_KEY |
google |
| Mistral | MISTRAL_API_KEY |
mistral |
| Groq | GROQ_API_KEY |
groq |
| Cerebras | CEREBRAS_API_KEY |
cerebras |
| Cloudflare AI Gateway | CLOUDFLARE_API_KEY (+ CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_GATEWAY_ID) |
cloudflare-ai-gateway |
| Cloudflare Workers AI | CLOUDFLARE_API_KEY (+ CLOUDFLARE_ACCOUNT_ID) |
cloudflare-workers-ai |
| xAI | XAI_API_KEY |
xai |
| OpenRouter | OPENROUTER_API_KEY |
openrouter |
| Vercel AI Gateway | AI_GATEWAY_API_KEY |
vercel-ai-gateway |
| ZAI | ZAI_API_KEY |
zai |
| OpenCode Zen | OPENCODE_API_KEY |
opencode |
| OpenCode Go | OPENCODE_API_KEY |
opencode-go |
| Hugging Face | HF_TOKEN |
huggingface |
| Fireworks | FIREWORKS_API_KEY |
fireworks |
| Kimi For Coding | KIMI_API_KEY |
kimi-coding |
| MiniMax | MINIMAX_API_KEY |
minimax |
| MiniMax (China) | MINIMAX_CN_API_KEY |
minimax-cn |
| Xiaomi MiMo | XIAOMI_API_KEY |
xiaomi |
| Xiaomi MiMo Token Plan (China) | XIAOMI_TOKEN_PLAN_CN_API_KEY |
xiaomi-token-plan-cn |
| Xiaomi MiMo Token Plan (Amsterdam) | XIAOMI_TOKEN_PLAN_AMS_API_KEY |
xiaomi-token-plan-ams |
| Xiaomi MiMo Token Plan (Singapore) | XIAOMI_TOKEN_PLAN_SGP_API_KEY |
xiaomi-token-plan-sgp |
Reference for environment variables and auth.json keys: env-api-keys.ts.
Store credentials in ~/.prime/agent/auth.json:
{
"anthropic": { "type": "api_key", "key": "sk-ant-..." },
"openai": { "type": "api_key", "key": "sk-..." },
"prime-inference": { "type": "api_key", "key": "..." },
"deepseek": { "type": "api_key", "key": "sk-..." },
"google": { "type": "api_key", "key": "..." },
"opencode": { "type": "api_key", "key": "..." },
"opencode-go": { "type": "api_key", "key": "..." },
"xiaomi": { "type": "api_key", "key": "..." },
"xiaomi-token-plan-cn": { "type": "api_key", "key": "..." },
"xiaomi-token-plan-ams": { "type": "api_key", "key": "..." },
"xiaomi-token-plan-sgp": { "type": "api_key", "key": "..." }
}The file is created with 0600 permissions (user read/write only). Auth file credentials take priority over environment variables, except for Prime Inference, where PRIME_API_KEY takes priority.
The key field supports three formats:
- Shell command:
"!command"executes and uses stdout (cached for process lifetime){ "type": "api_key", "key": "!security find-generic-password -ws 'anthropic'" } { "type": "api_key", "key": "!op read 'op://vault/item/credential'" } - Environment variable: Uses the value of the named variable
{ "type": "api_key", "key": "MY_ANTHROPIC_KEY" } - Literal value: Used directly
{ "type": "api_key", "key": "sk-ant-..." }
OAuth credentials are also stored here after /login and managed automatically.
Prime Inference uses the production OpenAI-compatible endpoint at https://api.pinference.ai/api/v1. Set PRIME_API_KEY or use /login to save a key for prime-inference in ~/.prime/agent/auth.json.
Normal startup, model discovery, inference, credential status, and team selection do not read Prime CLI credentials or URLs from ~/.prime/config.json. If you previously relied on CLI credentials, run /login once. During this explicit login, Agent can reuse a CLI key only when every configured CLI URL is a canonical production URL (or absent), the resolved Agent login destinations are production, and production /whoami validates the key. Local or development CLI configuration falls back to the browser login flow, which defaults to production.
An imported key and its CLI-file team selection are saved as an Agent-owned snapshot. Later CLI login, logout, URL, or team changes do not affect Agent. Agent login, team changes, and logout never write the CLI config. Saving a different key clears the previous Agent team to personal billing unless the login supplies a new team snapshot; saving the same key preserves the saved team.
PRIME_TEAM_ID overrides the request's X-Prime-Team-ID header but is never saved as the imported team. Runtime and PRIME_API_KEY credentials do not inherit a saved Agent team; set PRIME_TEAM_ID explicitly when using those credentials with team billing.
For deliberate development or test use, PRIME_AGENT_INFERENCE_API_BASE_URL overrides the Agent authentication and team API (default https://api.primeintellect.ai/api/v1). PRIME_AGENT_INFERENCE_FRONTEND_URL overrides the login browser frontend (default https://app.primeintellect.ai). These Agent-specific settings apply to browser login, manual-key validation, and team lookup. They do not change model inference URLs. CLI credential reuse is disabled when either resolved login destination is nonproduction. Legacy PRIME_API_BASE_URL and CLI-file URLs do not control Agent authentication.
Trace sharing remains opt-in. Normal uploads use explicit environment or Agent-owned credentials, never a live CLI credential fallback. /traces login can reuse a CLI key only after the same production URL checks and production validation, including the required agent_traces scope. The trace API defaults to https://api.primeintellect.ai; only the trace-specific PRIME_AGENT_TRACES_BASE_URL overrides that default, not CLI URLs or PRIME_API_BASE_URL. Explicit trace login does not reuse CLI credentials when its resolved trace API destination is nonproduction.
export AZURE_OPENAI_API_KEY=...
export AZURE_OPENAI_BASE_URL=https://your-resource.openai.azure.com
# also supported: https://your-resource.cognitiveservices.azure.com
# root endpoints are auto-normalized to /openai/v1
# or use resource name instead of base URL
export AZURE_OPENAI_RESOURCE_NAME=your-resource
# Optional
export AZURE_OPENAI_API_VERSION=2024-02-01
export AZURE_OPENAI_DEPLOYMENT_NAME_MAP=gpt-4=my-gpt4,gpt-4o=my-gpt4o# Option 1: AWS Profile
export AWS_PROFILE=your-profile
# Option 2: IAM Keys
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
# Option 3: Bearer Token
export AWS_BEARER_TOKEN_BEDROCK=...
# Optional region (defaults to us-east-1)
export AWS_REGION=us-west-2Also supports ECS task roles (AWS_CONTAINER_CREDENTIALS_*) and IRSA (AWS_WEB_IDENTITY_TOKEN_FILE).
prime-agent --provider amazon-bedrock --model us.anthropic.claude-sonnet-4-20250514-v1:0Prompt caching is enabled automatically for Claude models whose ID contains a recognizable model name (base models and system-defined inference profiles). For application inference profiles (whose ARNs don't contain the model name), set AWS_BEDROCK_FORCE_CACHE=1 to enable cache points:
export AWS_BEDROCK_FORCE_CACHE=1
prime-agent --provider amazon-bedrock --model arn:aws:bedrock:us-east-1:123456789012:application-inference-profile/abc123If you are connecting to a Bedrock API proxy, the following environment variables can be used:
# Set the URL for the Bedrock proxy (standard AWS SDK env var)
export AWS_ENDPOINT_URL_BEDROCK_RUNTIME=https://my.corp.proxy/bedrock
# Set if your proxy does not require authentication
export AWS_BEDROCK_SKIP_AUTH=1
# Set if your proxy only supports HTTP/1.1
export AWS_BEDROCK_FORCE_HTTP1=1CLOUDFLARE_API_KEY can be set via /login. The account ID and gateway slug must be set as environment variables.
export CLOUDFLARE_API_KEY=... # or use /login
export CLOUDFLARE_ACCOUNT_ID=...
export CLOUDFLARE_GATEWAY_ID=... # create at dash.cloudflare.com → AI → AI Gateway
prime-agent --provider cloudflare-ai-gateway --model "claude-sonnet-4-5"Routes to OpenAI and Anthropic through Cloudflare AI Gateway. OpenAI uses the OpenAI passthrough route (/openai) with native OpenAI model IDs such as gpt-5.1. Anthropic uses the Anthropic passthrough route (/anthropic) with native Anthropic model IDs such as claude-sonnet-4-5. Cloudflare-hosted @cf/... models are available through the separate cloudflare-workers-ai provider.
AI Gateway authentication uses CLOUDFLARE_API_KEY as cf-aig-authorization. Upstream authentication can be one of:
| Mode | Request auth | Upstream auth |
|---|---|---|
| Workers AI | Cloudflare token only | Cloudflare-native |
| Unified billing | Cloudflare token only | Cloudflare handles upstream auth and deducts credits |
| Stored BYOK | Cloudflare token only | Cloudflare injects provider keys stored in the AI Gateway dashboard |
| Inline BYOK | Cloudflare token plus upstream Authorization header |
The request supplies the upstream provider key |
For normal Prime Agent usage, prefer unified billing or stored BYOK. Inline BYOK requires configuring an additional upstream Authorization header for the Cloudflare AI Gateway provider, for example via a models.json provider/model override.
CLOUDFLARE_API_KEY can be set via /login. CLOUDFLARE_ACCOUNT_ID must be set as an environment variable.
export CLOUDFLARE_API_KEY=... # or use /login
export CLOUDFLARE_ACCOUNT_ID=...
prime-agent --provider cloudflare-workers-ai --model "@cf/moonshotai/kimi-k2.6"Prime Agent automatically sets x-session-affinity for prefix caching discounts.
Uses Application Default Credentials:
gcloud auth application-default login
export GOOGLE_CLOUD_PROJECT=your-project
export GOOGLE_CLOUD_LOCATION=us-central1Or set GOOGLE_APPLICATION_CREDENTIALS to a service account key file.
Via models.json: Add Ollama, LM Studio, vLLM, or any provider that speaks a supported API (OpenAI Completions, OpenAI Responses, Anthropic Messages, Google Generative AI). See models.md.
Via extensions: For providers that need custom API implementations or OAuth flows, create an extension. See custom-provider.md and examples/extensions/custom-provider-gitlab-duo.
For Prime Inference:
- CLI
--api-keyflag (runtime override) PRIME_API_KEY- Agent
auth.jsonentry - Custom provider keys from
models.json
Prime CLI config is not part of normal credential resolution.
For other providers:
- CLI
--api-keyflag auth.jsonentry (API key or OAuth token)- Environment variable
- Custom provider keys from
models.json