How to Authenticate with Different LLM Provider APIs Using Environment Variables in free-llm-api-resources

The pull_available_models.py script authenticates with each LLM provider by reading dedicated API keys from environment variables loaded via python-dotenv, interpolating them as Bearer tokens into HTTP Authorization headers.

The cheahjs/free-llm-api-resources repository aggregates available models from multiple LLM providers into a unified dataset. The central automation script, src/pull_available_models.py, handles authentication with diverse API endpoints by externalizing credentials into environment variables, keeping the codebase free from hard-coded secrets while supporting providers like Groq, Cloudflare, and Cohere.

Loading Environment Variables with python-dotenv

At the top of src/pull_available_models.py (line 22), the script initializes the python-dotenv library to load variables from a local .env file into the process environment:

from dotenv import load_dotenv
import os

load_dotenv()  # Makes .env variables available via os.environ

This allows developers to store sensitive credentials in a .env file excluded from version control while the script accesses them uniformly via os.environ.

Per-Provider Authentication Patterns

Each fetch_*_models helper function constructs HTTP requests using provider-specific environment variables. The authentication patterns fall into several categories based on how credentials are transmitted.

Standard Bearer Token Authentication

Most providers require a simple API key passed as a Bearer token in the Authorization header. The script interpolates the environment variable directly into the header dictionary:

Groq uses GROQ_API_KEY for both chat completion (lines 53-55) and audio transcription requests (lines 90-92):

headers = {
    "Authorization": f"Bearer {os.environ['GROQ_API_KEY']}"
}

Similarly, Hyperbolic (lines 11-13), Lambda Labs (lines 62-64), Scaleway (lines 5-7), and Cohere (lines 25-27) follow this exact pattern with their respective HYPERBOLIC_API_KEY, LAMBDA_API_KEY, SCALEWAY_API_KEY, and COHERE_API_KEY variables.

Multi-Credential Providers

Cloudflare requires two distinct environment variables: CLOUDFLARE_API_KEY and CLOUDFLARE_ACCOUNT_ID. The script uses both when fetching the model list (lines 45-48), incorporating the account ID into the request path while using the API key in the Authorization header.

Path-Based Authentication

Google Gemini (quota client) uses GCP_PROJECT_ID (lines 26-28) differently than the Bearer token pattern. Instead of a header, the project ID interpolates into the request URL path to identify the Google Cloud project for quota queries.

Public and Hard-Coded Endpoints

Not all providers require environment-based authentication:

• OpenRouter requires no external key; the script filters for publicly available free models.
• GitHub, SambaNova, and Chutes use public endpoints that require no authentication.
• OVH uses a hard-coded API key embedded directly in the request headers rather than reading from environment variables.

Error Handling for Missing Credentials

If a required environment variable is absent, Python raises a KeyError when os.environ['PROVIDER_API_KEY'] is accessed. This causes the script to abort immediately, preventing silent failures and ensuring users configure their environment before execution. To avoid this, ensure all needed variables exist in your .env file or system environment.

Configuration Example

Create a .env file in your project root with the following structure:

GROQ_API_KEY=sk-your-groq-key
CLOUDFLARE_API_KEY=sk-your-cloudflare-key
CLOUDFLARE_ACCOUNT_ID=your-account-id
HYPERBOLIC_API_KEY=sk-your-hyperbolic-key
LAMBDA_API_KEY=sk-your-lambda-key
SCALEWAY_API_KEY=sk-your-scaleway-key
COHERE_API_KEY=sk-your-cohere-key
GCP_PROJECT_ID=your-gcp-project-id

Run the script after installing dependencies:

pip install -r src/requirements.txt
python src/pull_available_models.py

The load_dotenv() call at startup automatically injects these values into os.environ, making them available for all provider authentication blocks.

Summary

• The script uses python-dotenv to load credentials from a .env file into os.environ at startup (line 22).
• Each provider follows the pattern os.environ['{PROVIDER}_API_KEY'] interpolated into Bearer token headers.
• Cloudflare requires both CLOUDFLARE_API_KEY and CLOUDFLARE_ACCOUNT_ID.
• Google Gemini uses GCP_PROJECT_ID in the request path rather than headers.
• Missing environment variables trigger KeyError exceptions, halting execution to ensure proper configuration.
• OpenRouter, GitHub, SambaNova, and Chutes require no authentication, while OVH uses hard-coded credentials.

Frequently Asked Questions

What happens if I don't set all the API keys in my environment?

The script will raise a KeyError and terminate when it attempts to access a missing environment variable like os.environ['GROQ_API_KEY']. This fail-fast behavior prevents partial data collection and ensures you explicitly configure only the providers you intend to use.

Can I run the script with only some providers enabled?

Yes. The script loads all environment variables at startup but only accesses specific keys when calling individual fetch_*_models functions. If you omit GROQ_API_KEY but don't call the Groq fetching function (or handle the exception), the script continues operating with other providers. However, the current implementation attempts to fetch from all providers, so you should either comment out unused fetch calls or provide all required keys.

Why does Cloudflare need two environment variables while others need one?

Cloudflare's API architecture requires both an account identifier (CLOUDFLARE_ACCOUNT_ID) to route requests to the correct tenant and an authentication key (CLOUDFLARE_API_KEY). This differs from simpler APIs that only require a single secret token for identity and authorization.

Is it safe to commit the .env file to version control?

No. The .env file contains sensitive API keys that grant access to paid services. The cheahjs/free-llm-api-resources repository excludes this file via .gitignore (or expects users to create it locally). Always keep .env out of version control and share example configurations via .env.example files with placeholder values instead.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}