# How to Authenticate with Different LLM Provider APIs Using Environment Variables in free-llm-api-resources

> Learn how the pull_available_models.py script authenticates with LLM provider APIs using environment variables and Bearer tokens. Secure your API access effortlessly.

- Repository: [Jun Siang Cheah/free-llm-api-resources](https://github.com/cheahjs/free-llm-api-resources)
- Tags: how-to-guide
- Published: 2026-05-07

---

**The [`pull_available_models.py`](https://github.com/cheahjs/free-llm-api-resources/blob/main/pull_available_models.py) script authenticates with each LLM provider by reading dedicated API keys from environment variables loaded via `python-dotenv`, interpolating them as Bearer tokens into HTTP `Authorization` headers.**

The `cheahjs/free-llm-api-resources` repository aggregates available models from multiple LLM providers into a unified dataset. The central automation script, [`src/pull_available_models.py`](https://github.com/cheahjs/free-llm-api-resources/blob/main/src/pull_available_models.py), handles authentication with diverse API endpoints by externalizing credentials into environment variables, keeping the codebase free from hard-coded secrets while supporting providers like Groq, Cloudflare, and Cohere.

## Loading Environment Variables with python-dotenv

At the top of [`src/pull_available_models.py`](https://github.com/cheahjs/free-llm-api-resources/blob/main/src/pull_available_models.py) (line 22), the script initializes the `python-dotenv` library to load variables from a local `.env` file into the process environment:

```python
from dotenv import load_dotenv
import os

load_dotenv()  # Makes .env variables available via os.environ

```

This allows developers to store sensitive credentials in a `.env` file excluded from version control while the script accesses them uniformly via `os.environ`.

## Per-Provider Authentication Patterns

Each `fetch_*_models` helper function constructs HTTP requests using provider-specific environment variables. The authentication patterns fall into several categories based on how credentials are transmitted.

### Standard Bearer Token Authentication

Most providers require a simple API key passed as a Bearer token in the `Authorization` header. The script interpolates the environment variable directly into the header dictionary:

**Groq** uses `GROQ_API_KEY` for both chat completion (lines 53-55) and audio transcription requests (lines 90-92):

```python
headers = {
    "Authorization": f"Bearer {os.environ['GROQ_API_KEY']}"
}

```

Similarly, **Hyperbolic** (lines 11-13), **Lambda Labs** (lines 62-64), **Scaleway** (lines 5-7), and **Cohere** (lines 25-27) follow this exact pattern with their respective `HYPERBOLIC_API_KEY`, `LAMBDA_API_KEY`, `SCALEWAY_API_KEY`, and `COHERE_API_KEY` variables.

### Multi-Credential Providers

**Cloudflare** requires two distinct environment variables: `CLOUDFLARE_API_KEY` and `CLOUDFLARE_ACCOUNT_ID`. The script uses both when fetching the model list (lines 45-48), incorporating the account ID into the request path while using the API key in the Authorization header.

### Path-Based Authentication

**Google Gemini** (quota client) uses `GCP_PROJECT_ID` (lines 26-28) differently than the Bearer token pattern. Instead of a header, the project ID interpolates into the request URL path to identify the Google Cloud project for quota queries.

### Public and Hard-Coded Endpoints

Not all providers require environment-based authentication:

- **OpenRouter** requires no external key; the script filters for publicly available free models.
- **GitHub**, **SambaNova**, and **Chutes** use public endpoints that require no authentication.
- **OVH** uses a hard-coded API key embedded directly in the request headers rather than reading from environment variables.

## Error Handling for Missing Credentials

If a required environment variable is absent, Python raises a `KeyError` when `os.environ['PROVIDER_API_KEY']` is accessed. This causes the script to abort immediately, preventing silent failures and ensuring users configure their environment before execution. To avoid this, ensure all needed variables exist in your `.env` file or system environment.

## Configuration Example

Create a `.env` file in your project root with the following structure:

```dotenv
GROQ_API_KEY=sk-your-groq-key
CLOUDFLARE_API_KEY=sk-your-cloudflare-key
CLOUDFLARE_ACCOUNT_ID=your-account-id
HYPERBOLIC_API_KEY=sk-your-hyperbolic-key
LAMBDA_API_KEY=sk-your-lambda-key
SCALEWAY_API_KEY=sk-your-scaleway-key
COHERE_API_KEY=sk-your-cohere-key
GCP_PROJECT_ID=your-gcp-project-id

```

Run the script after installing dependencies:

```bash
pip install -r src/requirements.txt
python src/pull_available_models.py

```

The `load_dotenv()` call at startup automatically injects these values into `os.environ`, making them available for all provider authentication blocks.

## Summary

- The script uses `python-dotenv` to load credentials from a `.env` file into `os.environ` at startup (line 22).
- Each provider follows the pattern `os.environ['{PROVIDER}_API_KEY']` interpolated into Bearer token headers.
- Cloudflare requires both `CLOUDFLARE_API_KEY` and `CLOUDFLARE_ACCOUNT_ID`.
- Google Gemini uses `GCP_PROJECT_ID` in the request path rather than headers.
- Missing environment variables trigger `KeyError` exceptions, halting execution to ensure proper configuration.
- OpenRouter, GitHub, SambaNova, and Chutes require no authentication, while OVH uses hard-coded credentials.

## Frequently Asked Questions

### What happens if I don't set all the API keys in my environment?

The script will raise a `KeyError` and terminate when it attempts to access a missing environment variable like `os.environ['GROQ_API_KEY']`. This fail-fast behavior prevents partial data collection and ensures you explicitly configure only the providers you intend to use.

### Can I run the script with only some providers enabled?

Yes. The script loads all environment variables at startup but only accesses specific keys when calling individual `fetch_*_models` functions. If you omit `GROQ_API_KEY` but don't call the Groq fetching function (or handle the exception), the script continues operating with other providers. However, the current implementation attempts to fetch from all providers, so you should either comment out unused fetch calls or provide all required keys.

### Why does Cloudflare need two environment variables while others need one?

Cloudflare's API architecture requires both an account identifier (`CLOUDFLARE_ACCOUNT_ID`) to route requests to the correct tenant and an authentication key (`CLOUDFLARE_API_KEY`). This differs from simpler APIs that only require a single secret token for identity and authorization.

### Is it safe to commit the .env file to version control?

No. The `.env` file contains sensitive API keys that grant access to paid services. The `cheahjs/free-llm-api-resources` repository excludes this file via `.gitignore` (or expects users to create it locally). Always keep `.env` out of version control and share example configurations via `.env.example` files with placeholder values instead.