Agent Code talks to LLM providers with either an API key or a subscription login. Pick whichever matches how you already pay for models.

API keys (default)

Set the env var for your provider before launching:

export ANTHROPIC_API_KEY=sk-ant-…
# or OPENAI_API_KEY, XAI_API_KEY, GOOGLE_API_KEY, OPENROUTER_API_KEY, …
agent
ProviderEnvironment variable
AnthropicANTHROPIC_API_KEY
OpenAIOPENAI_API_KEY
xAIXAI_API_KEY
GoogleGOOGLE_API_KEY
DeepSeekDEEPSEEK_API_KEY
GroqGROQ_API_KEY
MistralMISTRAL_API_KEY
TogetherTOGETHER_API_KEY
ZhipuZHIPU_API_KEY
CohereCOHERE_API_KEY
PerplexityPERPLEXITY_API_KEY
OpenRouterOPENROUTER_API_KEY

Override base URL for Azure, proxies, or local servers:

agent --api-base-url https://my-proxy.example/v1 --model gpt-5.5
# or Ollama
agent --api-base-url http://127.0.0.1:11434/v1 --model llama3.2

Keys are never written into config files. Env vars and the OS keychain/session stores used by login flows only.

Subscription login

ChatGPT / Codex

agent login codex
agent --auth-mode codex_chatgpt --model gpt-5.5

Uses the same session file as the official Codex CLI (~/.codex/auth.json). If you already ran codex login, Agent Code reuses that session — no second browser dance.

SuperGrok / X Premium (xAI)

agent login xai
agent --auth-mode xai_oauth --model grok-build-0.1

Device-code / OAuth flow. If you already authenticated via the official grok login, Agent Code can reuse ~/.grok/auth.json.

First-run setup

Launching agent with no credentials starts the setup wizard, which offers API key entry and both subscription options.

Selecting auth mode

MechanismExample
CLIagent --auth-mode api_key · codex_chatgpt · xai_oauth
EnvAGENT_CODE_AUTH_MODE=codex_chatgpt
Config[api] auth_mode = "xai_oauth" in config.toml

Headless / CI

Prefer API keys in CI:

export ANTHROPIC_API_KEY="…"
agent -p "run the unit tests and report failures" --permission-mode allow

Do not commit .env files or paste keys into the repo. For org policies that forbid bypass flags, set:

[security]
disable_bypass_permissions = true