openshell provider

CLI reference for provider commands: create, get, list, update, and delete. Providers are named credential bundles injected into sandboxes at creation.

openshell provider

Providers are named credential bundles — API keys, tokens, and service accounts — that are injected into sandboxes as environment variables at creation time. Credentials are never written to the sandbox filesystem.

---

openshell provider create

Create a provider and register its credentials with the gateway.

openshell provider create --name NAME --type TYPE (--from-existing | --credential KEY[=VALUE]) [OPTIONS]

--name · string · required

Provider name. Used to reference the provider in sandbox create --provider.

--type · string · required

Provider type. Determines which environment variables are injected. Valid values:

Value	Credentials injected
claude	ANTHROPIC_API_KEY, CLAUDE_API_KEY
anthropic	ANTHROPIC_API_KEY, CLAUDE_API_KEY
openai	OPENAI_API_KEY
codex	OPENAI_API_KEY
opencode	OPENCODE_API_KEY, OPENROUTER_API_KEY, OPENAI_API_KEY
nvidia	NVIDIA_API_KEY
github	GITHUB_TOKEN, GH_TOKEN
gitlab	GITLAB_TOKEN, GLAB_TOKEN, CI_JOB_TOKEN
outlook	Outlook OAuth credentials
generic	Any custom env var (specified with --credential)

--from-existing · boolean

Load credentials from existing local state — reads from the current environment variables and known config files for the provider type. Conflicts with --credential.

--credential · string

Credential pair in KEY=VALUE format, or just a KEY to read from the current environment. Repeatable for multiple credentials. Conflicts with --from-existing.

Examples:

• --credential OPENAI_API_KEY — reads value from $OPENAI_API_KEY.
• --credential OPENAI_API_KEY=sk-... — sets the value directly.

--config · string

Provider config key/value pair in KEY=VALUE format. Repeatable. Use for non-credential configuration that travels with the provider.

Either --from-existing or at least one --credential is required. The two flags are mutually exclusive.

Examples

# Create an OpenAI provider from the current environment
openshell provider create --name openai --type openai --from-existing

# Create an Anthropic provider with an explicit key
openshell provider create --name anthropic --type anthropic --credential ANTHROPIC_API_KEY=sk-ant-...

# Create a GitHub provider (reads GITHUB_TOKEN from env)
openshell provider create --name github --type github --credential GITHUB_TOKEN

# Create a generic provider with a custom env var
openshell provider create --name my-api --type generic --credential MY_API_KEY=abc123

---

openshell provider get

Fetch details for a provider by name.

openshell provider get NAME

NAME · string · required

Provider name.

---

openshell provider list

List providers registered with the active gateway.

openshell provider list [OPTIONS]

--limit · integer · default: "100"

Maximum number of providers to return.

--offset · integer · default: "0"

Offset into the provider list for pagination.

--names · boolean

Print only provider names, one per line.

Examples

openshell provider list
openshell provider list --names

---

openshell provider update

Update an existing provider’s credentials or config.

openshell provider update NAME (--from-existing | --credential KEY[=VALUE]) [OPTIONS]

NAME · string · required

Provider name to update.

--from-existing · boolean

Re-discover credentials from local state (env vars, config files). Conflicts with --credential.

--credential · string

New credential pair in KEY=VALUE format, or just a KEY to read from the current environment. Repeatable. Conflicts with --from-existing.

--config · string

Provider config key/value pair in KEY=VALUE format. Repeatable.

Examples

# Rotate an API key by re-reading from the environment
openshell provider update openai --from-existing

# Set a new explicit key value
openshell provider update openai --credential OPENAI_API_KEY=sk-new-...

---

openshell provider delete

Delete one or more providers by name.

openshell provider delete NAME [NAME...]

NAME · string · required

One or more provider names to delete.

Examples

openshell provider delete openai
openshell provider delete openai anthropic

---

Provider types and env vars

The following table lists recognized provider types and the environment variables the CLI reads when --from-existing is set.

Type	Environment variables read
claude / anthropic	ANTHROPIC_API_KEY, CLAUDE_API_KEY
openai / codex	OPENAI_API_KEY
opencode	OPENCODE_API_KEY, OPENROUTER_API_KEY, OPENAI_API_KEY
nvidia	NVIDIA_API_KEY
github	GITHUB_TOKEN, GH_TOKEN
gitlab	GITLAB_TOKEN, GLAB_TOKEN, CI_JOB_TOKEN
outlook	Outlook OAuth state
generic	Any env var specified with --credential

For agents that auto-discover credentials (Claude, Codex, OpenCode, GitHub Copilot), --from-existing is the fastest path: it reads from the current shell environment without requiring you to specify key names.