AGI
Contact salesSign inTry AGI Web
Bring your own keys

Bring your own provider keys.

Read the provider-key guideCheck surface availability
BYOK · key custody
  • CLIComing soon. Keys saved with provider-key login use the OS credential store except on Linux or when AGIWORKFORCE_NO_KEYRING disables the keyring. In those cases, these saved keys use files in the CLI configuration directory.
  • VS CodeComing soon. Provider-key management requires a connected local CLI runtime and delegates key storage to that runtime. The CLI storage rules apply.
  • AGI account keyVS Code stores its separate AGI Workforce account API key in SecretStorage. This is distinct from provider-key management.

provider keyCLI runtimeseparate account sign-in

What BYOK covers.

Bring your own API keys to AGI CLI and VS Code. The CLI and VS Code are coming soon.

  • SurfacesCLI · VS Code
  • AvailabilityThe CLI and VS Code are coming soon.
  • Provider-key storageCLI runtime
  • Account sign-inSeparate from provider-key login
Key custody

Provider keys use the CLI runtime.

VS Code provider-key management uses its connected CLI runtime. Desktop runs on your AGI account and takes no provider key. CLI Managed Cloud requests require an AGI account token rather than a saved provider API key.

  • CLIComing soon. Keys saved with provider-key login use the OS credential store except on Linux or when AGIWORKFORCE_NO_KEYRING disables the keyring. In those cases, these saved keys use files in the CLI configuration directory.
  • VS CodeComing soon. Provider-key management requires a connected local CLI runtime and delegates key storage to that runtime. The CLI storage rules apply.
  • AGI account keyVS Code stores its separate AGI Workforce account API key in SecretStorage. This is distinct from provider-key management.
Provider-key setup

Add and inspect a provider key.

With an installed CLI, use a supported provider name when adding a key. A bare agi login starts AGI managed-cloud sign-in. See the provider-key guide for storage rules and custom endpoint configuration.

  • agi login --helpInspect the login command usage.
  • agi login <provider>Paste a supported provider API key when prompted.
  • agi auth-statusReports stored credentials; it does not validate the key with the provider.
Surface boundary

Check the surface before adding a key.

Web, Mobile, Desktop and Chrome do not accept provider keys. Carrying an existing thread across local, BYOK, and managed cloud is a separate question, answered on the FAQ.

Choose a provider.

Use the provider catalog and the product’s model picker when choosing a provider or model. Review your provider’s billing and data-use terms before using a key.

Browse the provider catalog