Configure providers

llmshim needs credentials only for the provider that handles a request. Configure one provider to begin; add others when you want to switch models.

Availability: Rust: environment, optional config load · CLI/proxy: environment + config file · Clients: the proxy owns provider keys

Option 1: environment variables

Set one or more variables in the environment of the process that runs llmshim:

export OPENAI_API_KEY=sk-...
export ANTHROPIC_API_KEY=sk-ant-...
export GEMINI_API_KEY=AIza...
export XAI_API_KEY=xai-...

The Rust crate reads these variables when Router::from_env() is constructed. The CLI and proxy read them at startup.

Option 2: ~/.llmshim/config.toml

Use the interactive command to create or update the shared config file:

llmshim configure

It prompts for all four provider keys, the proxy host, and the proxy port. Press Enter to keep an existing value. The resulting file is used by CLI chat and the proxy.

You can also manage individual values:

llmshim set anthropic sk-ant-...
llmshim get anthropic
llmshim list

Valid key names are openai, anthropic, gemini, xai, proxy.host, and proxy.port. get and list mask stored API keys. Be aware that a value passed to set may remain in your shell history; the interactive command avoids that shell-history exposure.

On Unix, loading the default config also repairs its file mode to 0600 and the owned .llmshim directory mode to 0700. The default file must be a regular file owned by the current user, with no symlink or additional hard link; unsafe paths are ignored with a diagnostic. Already-private files need no permission change, so read-only loads still work on read-only filesystems. Use environment variables for operator-managed secrets outside this default storage layout.

Option 3: ChatGPT subscription login

llmshim login chatgpt

Open the printed URL, sign in, and enter the device code. Select chatgpt/gpt-6-astra, chatgpt/gpt-6-sol, chatgpt/gpt-6.1-sol, or chatgpt/gpt-6-luna. Only those four models are supported. ChatGPT tokens are stored separately from API keys and refreshed automatically. Device login may need enabling in ChatGPT security settings or workspace permissions.

llmshim login chatgpt --status checks the saved session. See ChatGPT OAuth configuration for custom cache paths and container setup.

Precedence: environment wins

The CLI and proxy call llmshim::env::load_all(). It reads ~/.llmshim/config.toml, but fills only variables that are not already set:

environment variable  >  config file  >  not configured

This makes a shell, container, or deployment secret override the local file without editing it.

Router::from_env() does not load the file on its own. A Rust application that wants the same behavior must call llmshim::env::load_all() first. See Environment variables versus config.toml.

Check what is available

llmshim models

The command lists registry entries only for providers whose keys or OAuth cache are available after applying the precedence above. Runtime discovery is the canonical way to see the current curated model list.

Go and Ruby clients never receive provider keys directly; they connect to a proxy that owns them. Python and TypeScript auto-started proxies inherit the current environment and use the same config-file loading behavior.