# How to Configure Provider-Specific API Credentials in AISuite

> Easily configure provider specific API credentials in AISuite. Learn to set API keys via environment variables, programmatically, or through the secret store. Maximize efficiency and security.

- Repository: [Andrew Ng/aisuite](https://github.com/andrewyng/aisuite)
- Tags: how-to-guide
- Published: 2026-08-03

---

**Set your API keys via environment variables (e.g., `OPENAI_API_KEY`), pass them programmatically through `Client.configure()`, or store them securely in AISuite's secret store—each provider descriptor in [`platform/coworker/providers/registry.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/registry.py) defines how keys are resolved at runtime.**

AISuite provides a flexible, provider-agnostic interface for working with Large Language Models (LLMs) from OpenAI, Anthropic, Google Gemini, and others. Configuring **provider-specific API credentials** correctly ensures your requests authenticate properly without leaking keys across endpoints. According to the aisuite source code, each provider follows a clear, hierarchical key resolution strategy implemented in its descriptor and `resolve_api_key` helper.

## Three Methods to Configure API Credentials in AISuite

AISuite supports three credential sources, checked in priority order when a provider client is built.

### Method 1: Environment Variables (Recommended for Development)

Each provider descriptor declares an `env_key` that maps to a standard environment variable name. As defined in [`platform/coworker/providers/registry.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/registry.py) (lines 68–70), common mappings include:

- `OPENAI_API_KEY` → OpenAI provider
- `ANTHROPIC_API_KEY` → Anthropic provider
- `GEMINI_API_KEY` → Google Gemini provider

Set these in your shell before launching AISuite or your Python script:

```bash
export OPENAI_API_KEY="sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export ANTHROPIC_API_KEY="sk-ant-xxxxxxxxxxxxxxxxxxxxxxxx"
export GEMINI_API_KEY="AIzaXXXXXXXXXXXXXXXXXXXXXXXX"

```

The provider's `resolve_api_key` helper automatically picks up these values via `os.environ.get(env_key)`.

### Method 2: Programmatic Configuration via `Client.configure()`

For dynamic or multi-tenant scenarios, pass credentials directly through the client. In [`aisuite/client.py`](https://github.com/andrewyng/aisuite/blob/main/aisuite/client.py), the `Client.configure()` method accepts a dictionary mapping provider names to their configuration:

```python
from aisuite.client import Client

client = Client()

client.configure({
    "openai": {"api_key": "sk-xxxxxxxxxxxxxxxxxxxx"},
    "anthropic": {"api_key": "sk-ant-xxxxxxxxxxxxxxx"},
    "gemini": {"api_key": "AIzaXXXXXXXXXXXXXXXX"},
})

response = client.chat.completions.create(
    model="openai:gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello"}],
)

```

This **explicit value** takes precedence over environment variables during key resolution.

### Method 3: Secret Store (Recommended for Production/ Desktop Use)

When AISuite runs as a desktop application, it cannot inherit shell environment variables. Instead, it uses a **SecretStore** profile keyed as `provider:<name>`. To configure:

1. Open AISuite → **Settings** → **Models**
2. Select a provider (e.g., "OpenAI")
3. Paste your API key into the rendered field (defined by the provider's `ProviderField` with `field="api_key"` in [`registry.py`](https://github.com/andrewyng/aisuite/blob/main/registry.py))
4. Click **Save**—the key persists as `provider:openai` in the secret store

At runtime, the provider's `resolve_api_key` helper checks `secrets.get("provider:<name>")` as its final fallback.

## How Key Resolution Works: The `resolve_api_key` Pattern

Each provider implements the same resolution logic. Examining [`platform/coworker/providers/openai_provider.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/openai_provider.py) (lines 23–33), the hierarchy is:

1. **Explicit configuration** from `Client.configure()`
2. **Environment variable** via `os.environ.get(env_key)`
3. **SecretStore lookup** via `secrets.get(f"provider:{provider_name}")`

If all sources return `None`, the provider raises a clear error: *"No model API key configured for [provider]"*. This prevents accidental credential leakage—your OpenAI key will never be sent to an Anthropic endpoint.

## Configuring Custom or Self-Hosted Endpoints

AISuite supports OpenAI-compatible APIs including **Azure OpenAI**, **Ollama**, or other custom endpoints. Pass additional parameters in `Client.configure()`:

```python
from aisuite.client import Client

client = Client()

client.configure({
    "openai": {
        "api_key": "sk-azure-xxxxxxxxxxxx",
        "base_url": "https://my-azure-resource.openai.azure.com/openai/v1"
    },
    "ollama": {
        "base_url": "http://localhost:11434"  # No API key required

    },
})

```

The `base_url` parameter overrides the default endpoint defined in the provider descriptor ([`platform/coworker/providers/registry.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/registry.py), lines 86–108).

## Key Source Files for Provider Credential Configuration

| File | Purpose |
|------|---------|
| [`platform/coworker/providers/registry.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/registry.py) | Defines `ProviderField` for UI rendering, `env_key` for environment mapping, and default endpoints (lines 68–70, 86–108) |
| [`platform/coworker/providers/openai_provider.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/openai_provider.py) | Implements `resolve_api_key()` with environment and secret store fallback (lines 23–33) |
| [`platform/coworker/providers/anthropic_provider.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/anthropic_provider.py) | Same resolution pattern for Anthropic models |
| [`platform/coworker/providers/gemini_provider.py`](https://github.com/andrewyng/aisuite/blob/main/platform/coworker/providers/gemini_provider.py) | Same resolution pattern for Google Gemini models |
| [`aisuite/client.py`](https://github.com/andrewyng/aisuite/blob/main/aisuite/client.py) | Exposes `Client.configure()` for programmatic credential injection |
| `.env.sample` | Repository template showing standard environment variable names |

## Summary

- **Environment variables** (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, etc.) are the simplest method for local development
- **`Client.configure()`** provides dynamic, per-instance credential control for multi-provider applications
- **SecretStore** via the Settings UI is designed for desktop deployments where shell environment inheritance is unavailable
- Each provider's `resolve_api_key` enforces strict key isolation, preventing cross-provider credential leakage
- Custom endpoints require only `base_url` in addition to `api_key` in the configuration dictionary

## Frequently Asked Questions

### What happens if I don't configure any API credentials?

AISuite raises a clear runtime error: *"No model API key configured for [provider]"*. This occurs in the provider's `resolve_api_key` helper when all three sources—explicit config, environment variable, and secret store—return `None`.

### Can I use different API keys for the same provider in different parts of my code?

Yes. Create separate `Client` instances and call `configure()` with different credentials on each. Since AISuite does not use global state, each client maintains its own provider configuration.

### Does AISuite support API keys stored in `.env` files?

AISuite itself does not load `.env` files, but you can use `python-dotenv` or similar tools to populate environment variables before importing aisuite. The repository includes `.env.sample` as a reference for standard variable names.

### Is there a way to configure credentials without exposing keys in code?

Use the **SecretStore** through the desktop Settings UI, or set environment variables in your deployment platform (Docker secrets, Kubernetes secrets, GitHub Actions encrypted variables). Both methods keep keys out of source code and version control.