How to Configure Provider-Specific API Credentials in AISuite

Set your API keys via environment variables (e.g., OPENAI_API_KEY), pass them programmatically through Client.configure(), or store them securely in AISuite's secret store—each provider descriptor in platform/coworker/providers/registry.py defines how keys are resolved at runtime.

AISuite provides a flexible, provider-agnostic interface for working with Large Language Models (LLMs) from OpenAI, Anthropic, Google Gemini, and others. Configuring provider-specific API credentials correctly ensures your requests authenticate properly without leaking keys across endpoints. According to the aisuite source code, each provider follows a clear, hierarchical key resolution strategy implemented in its descriptor and resolve_api_key helper.

Three Methods to Configure API Credentials in AISuite

AISuite supports three credential sources, checked in priority order when a provider client is built.

Method 1: Environment Variables (Recommended for Development)

Each provider descriptor declares an env_key that maps to a standard environment variable name. As defined in platform/coworker/providers/registry.py (lines 68–70), common mappings include:

• OPENAI_API_KEY → OpenAI provider
• ANTHROPIC_API_KEY → Anthropic provider
• GEMINI_API_KEY → Google Gemini provider

Set these in your shell before launching AISuite or your Python script:

export OPENAI_API_KEY="sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export ANTHROPIC_API_KEY="sk-ant-xxxxxxxxxxxxxxxxxxxxxxxx"
export GEMINI_API_KEY="AIzaXXXXXXXXXXXXXXXXXXXXXXXX"

The provider's resolve_api_key helper automatically picks up these values via os.environ.get(env_key).

Method 2: Programmatic Configuration via Client.configure()

For dynamic or multi-tenant scenarios, pass credentials directly through the client. In aisuite/client.py, the Client.configure() method accepts a dictionary mapping provider names to their configuration:

from aisuite.client import Client

client = Client()

client.configure({
    "openai": {"api_key": "sk-xxxxxxxxxxxxxxxxxxxx"},
    "anthropic": {"api_key": "sk-ant-xxxxxxxxxxxxxxx"},
    "gemini": {"api_key": "AIzaXXXXXXXXXXXXXXXX"},
})

response = client.chat.completions.create(
    model="openai:gpt-4o-mini",
    messages=[{"role": "user", "content": "Hello"}],
)

This explicit value takes precedence over environment variables during key resolution.

Method 3: Secret Store (Recommended for Production/ Desktop Use)

When AISuite runs as a desktop application, it cannot inherit shell environment variables. Instead, it uses a SecretStore profile keyed as provider:<name>. To configure:

1. Open AISuite → Settings → Models
2. Select a provider (e.g., "OpenAI")
3. Paste your API key into the rendered field (defined by the provider's ProviderField with field="api_key" in registry.py)
4. Click Save—the key persists as provider:openai in the secret store

At runtime, the provider's resolve_api_key helper checks secrets.get("provider:<name>") as its final fallback.

How Key Resolution Works: The resolve_api_key Pattern

Each provider implements the same resolution logic. Examining platform/coworker/providers/openai_provider.py (lines 23–33), the hierarchy is:

1. Explicit configuration from Client.configure()
2. Environment variable via os.environ.get(env_key)
3. SecretStore lookup via secrets.get(f"provider:{provider_name}")

If all sources return None, the provider raises a clear error: "No model API key configured for [provider]". This prevents accidental credential leakage—your OpenAI key will never be sent to an Anthropic endpoint.

Configuring Custom or Self-Hosted Endpoints

AISuite supports OpenAI-compatible APIs including Azure OpenAI, Ollama, or other custom endpoints. Pass additional parameters in Client.configure():

from aisuite.client import Client

client = Client()

client.configure({
    "openai": {
        "api_key": "sk-azure-xxxxxxxxxxxx",
        "base_url": "https://my-azure-resource.openai.azure.com/openai/v1"
    },
    "ollama": {
        "base_url": "http://localhost:11434"  # No API key required

    },
})

The base_url parameter overrides the default endpoint defined in the provider descriptor (platform/coworker/providers/registry.py, lines 86–108).

Key Source Files for Provider Credential Configuration

File	Purpose
platform/coworker/providers/registry.py	Defines ProviderField for UI rendering, env_key for environment mapping, and default endpoints (lines 68–70, 86–108)
platform/coworker/providers/openai_provider.py	Implements resolve_api_key() with environment and secret store fallback (lines 23–33)
platform/coworker/providers/anthropic_provider.py	Same resolution pattern for Anthropic models
platform/coworker/providers/gemini_provider.py	Same resolution pattern for Google Gemini models
aisuite/client.py	Exposes Client.configure() for programmatic credential injection
.env.sample	Repository template showing standard environment variable names

Summary

• Environment variables (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) are the simplest method for local development
• Client.configure() provides dynamic, per-instance credential control for multi-provider applications
• SecretStore via the Settings UI is designed for desktop deployments where shell environment inheritance is unavailable
• Each provider's resolve_api_key enforces strict key isolation, preventing cross-provider credential leakage
• Custom endpoints require only base_url in addition to api_key in the configuration dictionary

Frequently Asked Questions

What happens if I don't configure any API credentials?

AISuite raises a clear runtime error: "No model API key configured for [provider]". This occurs in the provider's resolve_api_key helper when all three sources—explicit config, environment variable, and secret store—return None.

Can I use different API keys for the same provider in different parts of my code?

Yes. Create separate Client instances and call configure() with different credentials on each. Since AISuite does not use global state, each client maintains its own provider configuration.

Does AISuite support API keys stored in .env files?

AISuite itself does not load .env files, but you can use python-dotenv or similar tools to populate environment variables before importing aisuite. The repository includes .env.sample as a reference for standard variable names.

Is there a way to configure credentials without exposing keys in code?

Use the SecretStore through the desktop Settings UI, or set environment variables in your deployment platform (Docker secrets, Kubernetes secrets, GitHub Actions encrypted variables). Both methods keep keys out of source code and version control.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}