Full reference

Bring your own provider credentials

Register an upstream provider credential in your workspace, validate it, and use a Stimulir application key in your application.

Updated

Reviewed against Console v0.2.2. Available actions depend on project access and runtime configuration; check your installed CLI version for command differences.

Register a provider, then check project routing

Use the interactive CLI steps below to add and verify an upstream provider credential. In the current Console, Settings → Organisation → Integrations manages tools such as code, messaging, and document services; it is not the provider-key setup form. Project routing is under Settings → Project → Routing. After registration, inspect Models and verify the actual request route. Enter the secret only into the credential prompt, never a chat or support message.

Choose the provider and credential

The credential’s provider determines its validation and routing behavior. Select a provider supported by the current Console or CLI. A provider credential and a hyb_* application key are different: applications call Stimulir; Stimulir uses the configured upstream route.

Add and verify

bash
stimulir byok add --provider openai --label application
stimulir byok list
stimulir byok verify <credential-id>

Omit --secret so the CLI prompts without echoing the value. Do not put an actual provider secret in command arguments. Use the returned credential ID for verification or removal.

Confirm an enabled route

Inspect the workspace model catalogue after configuring the provider. Confirm that a real request used the intended route in its trace and usage record. A saved credential is not proof that every model or account capability is available.

Operate and replace credentials

Rotate a provider key in both the provider account and Stimulir, then verify the replacement route before removing the old credential. Removing a credential can interrupt workloads depending on it. See Deployment modes for how BYOK differs from managed inference.

Command catalogue

Expand a command for its arguments. These commands follow the released CLI source; check stimulir --version and the command’s --help for your installation. Required flags are marked; some operations also validate combinations of inputs.

stimulir byok add

Store an encrypted provider credential and validate it.

--provider, -p required
Upstream provider.
--label, -l required
Label for this credential.
--secret
Provider API key (omit to be prompted without echo).
--json
Emit raw JSON output.
stimulir byok list

List BYOK credentials in the active workspace.

--json
Emit raw JSON output.
stimulir byok remove

Delete a stored credential.

credential_id required
Positional argument. Credential id (from stimulir byok list).
--yes, -y
Skip the confirmation prompt.
--json
Emit raw JSON output.
stimulir byok verify

Re-validate a stored credential against its provider.

credential_id required
Positional argument. Credential id (from stimulir byok list).
--json
Emit raw JSON output.