> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/NVIDIA/OpenShell/llms.txt
> Use this file to discover all available pages before exploring further.

# openshell provider

> CLI reference for provider commands: create, get, list, update, and delete. Providers are named credential bundles injected into sandboxes at creation.

# openshell provider

Providers are named credential bundles — API keys, tokens, and service accounts — that are injected into sandboxes as environment variables at creation time. Credentials are never written to the sandbox filesystem.

***

## openshell provider create

Create a provider and register its credentials with the gateway.

```bash theme={null}
openshell provider create --name NAME --type TYPE (--from-existing | --credential KEY[=VALUE]) [OPTIONS]
```

<ParamField body="--name" type="string" required>
  Provider name. Used to reference the provider in `sandbox create --provider`.
</ParamField>

<ParamField body="--type" type="string" required>
  Provider type. Determines which environment variables are injected. Valid values:

  | Value       | Credentials injected                                       |
  | ----------- | ---------------------------------------------------------- |
  | `claude`    | `ANTHROPIC_API_KEY`, `CLAUDE_API_KEY`                      |
  | `anthropic` | `ANTHROPIC_API_KEY`, `CLAUDE_API_KEY`                      |
  | `openai`    | `OPENAI_API_KEY`                                           |
  | `codex`     | `OPENAI_API_KEY`                                           |
  | `opencode`  | `OPENCODE_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY` |
  | `nvidia`    | `NVIDIA_API_KEY`                                           |
  | `github`    | `GITHUB_TOKEN`, `GH_TOKEN`                                 |
  | `gitlab`    | `GITLAB_TOKEN`, `GLAB_TOKEN`, `CI_JOB_TOKEN`               |
  | `outlook`   | Outlook OAuth credentials                                  |
  | `generic`   | Any custom env var (specified with `--credential`)         |
</ParamField>

<ParamField body="--from-existing" type="boolean">
  Load credentials from existing local state — reads from the current environment variables and known config files for the provider type. Conflicts with `--credential`.
</ParamField>

<ParamField body="--credential" type="string">
  Credential pair in `KEY=VALUE` format, or just a `KEY` to read from the current environment. Repeatable for multiple credentials. Conflicts with `--from-existing`.

  Examples:

  * `--credential OPENAI_API_KEY` — reads value from `$OPENAI_API_KEY`.
  * `--credential OPENAI_API_KEY=sk-...` — sets the value directly.
</ParamField>

<ParamField body="--config" type="string">
  Provider config key/value pair in `KEY=VALUE` format. Repeatable. Use for non-credential configuration that travels with the provider.
</ParamField>

<Note>
  Either `--from-existing` or at least one `--credential` is required. The two flags are mutually exclusive.
</Note>

### Examples

```bash theme={null}
# Create an OpenAI provider from the current environment
openshell provider create --name openai --type openai --from-existing

# Create an Anthropic provider with an explicit key
openshell provider create --name anthropic --type anthropic --credential ANTHROPIC_API_KEY=sk-ant-...

# Create a GitHub provider (reads GITHUB_TOKEN from env)
openshell provider create --name github --type github --credential GITHUB_TOKEN

# Create a generic provider with a custom env var
openshell provider create --name my-api --type generic --credential MY_API_KEY=abc123
```

***

## openshell provider get

Fetch details for a provider by name.

```bash theme={null}
openshell provider get NAME
```

<ParamField body="NAME" type="string" required>
  Provider name.
</ParamField>

***

## openshell provider list

List providers registered with the active gateway.

```bash theme={null}
openshell provider list [OPTIONS]
```

<ParamField body="--limit" type="integer" default="100">
  Maximum number of providers to return.
</ParamField>

<ParamField body="--offset" type="integer" default="0">
  Offset into the provider list for pagination.
</ParamField>

<ParamField body="--names" type="boolean">
  Print only provider names, one per line.
</ParamField>

### Examples

```bash theme={null}
openshell provider list
openshell provider list --names
```

***

## openshell provider update

Update an existing provider's credentials or config.

```bash theme={null}
openshell provider update NAME (--from-existing | --credential KEY[=VALUE]) [OPTIONS]
```

<ParamField body="NAME" type="string" required>
  Provider name to update.
</ParamField>

<ParamField body="--from-existing" type="boolean">
  Re-discover credentials from local state (env vars, config files). Conflicts with `--credential`.
</ParamField>

<ParamField body="--credential" type="string">
  New credential pair in `KEY=VALUE` format, or just a `KEY` to read from the current environment. Repeatable. Conflicts with `--from-existing`.
</ParamField>

<ParamField body="--config" type="string">
  Provider config key/value pair in `KEY=VALUE` format. Repeatable.
</ParamField>

### Examples

```bash theme={null}
# Rotate an API key by re-reading from the environment
openshell provider update openai --from-existing

# Set a new explicit key value
openshell provider update openai --credential OPENAI_API_KEY=sk-new-...
```

***

## openshell provider delete

Delete one or more providers by name.

```bash theme={null}
openshell provider delete NAME [NAME...]
```

<ParamField body="NAME" type="string" required>
  One or more provider names to delete.
</ParamField>

### Examples

```bash theme={null}
openshell provider delete openai
openshell provider delete openai anthropic
```

***

## Provider types and env vars

The following table lists recognized provider types and the environment variables the CLI reads when `--from-existing` is set.

| Type                   | Environment variables read                                 |
| ---------------------- | ---------------------------------------------------------- |
| `claude` / `anthropic` | `ANTHROPIC_API_KEY`, `CLAUDE_API_KEY`                      |
| `openai` / `codex`     | `OPENAI_API_KEY`                                           |
| `opencode`             | `OPENCODE_API_KEY`, `OPENROUTER_API_KEY`, `OPENAI_API_KEY` |
| `nvidia`               | `NVIDIA_API_KEY`                                           |
| `github`               | `GITHUB_TOKEN`, `GH_TOKEN`                                 |
| `gitlab`               | `GITLAB_TOKEN`, `GLAB_TOKEN`, `CI_JOB_TOKEN`               |
| `outlook`              | Outlook OAuth state                                        |
| `generic`              | Any env var specified with `--credential`                  |

<Tip>
  For agents that auto-discover credentials (Claude, Codex, OpenCode, GitHub Copilot), `--from-existing` is the fastest path: it reads from the current shell environment without requiring you to specify key names.
</Tip>