Providers

zot ships a broad provider catalog so /login, /model, --provider, and --list-models all speak the same IDs.

Use /login for subscription auth and simple API-key providers. Providers that need cloud-specific settings show setup guidance instead of opening a localhost browser form, which is safer for SSH, containers, and kubectl exec sessions.

HTTP proxy

Set one global proxy for zot-managed HTTP and HTTPS traffic with http_proxy in $ZOT_HOME/config.json:

{
  "http_proxy": "http://127.0.0.1:7890"
}

zot applies the setting at startup. Existing HTTP_PROXY, HTTPS_PROXY, http_proxy, and https_proxy environment variables take precedence for their corresponding protocol. NO_PROXY and no_proxy continue to control bypasses. Restart zot after changing the setting.

Subscription login

Anthropic Claude Pro/Max (anthropic), OpenAI Codex / ChatGPT Plus/Pro (openai-codex), Kimi Code (kimi), and GitHub Copilot (github-copilot). OAuth tokens are stored in $ZOT_HOME/auth.json and refreshed when supported.

GitHub Copilot

Use /login with github-copilot, or supply a GitHub token with Copilot access through COPILOT_GITHUB_TOKEN or GITHUB_COPILOT_TOKEN. The default model is claude-sonnet-5:

zot --provider github-copilot --model claude-sonnet-5

zot selects the wire protocol automatically. Claude uses Anthropic Messages with Copilot Bearer authentication, without Claude Code identity injection. GPT, Grok, and MAI use Responses. Gemini and Kimi use Chat Completions without reasoning_effort; their reasoning is managed by the endpoint. Requests include user/agent initiator metadata and image-request headers where appropriate.

At startup, zot queries Copilot's authenticated /models endpoint in the background. The runtime picker is filtered by model-picker visibility, policy state, and tool-call support. Individual accounts with no eligible picker entries can fall back to explicitly enabled policies; other account types cannot. zot never enables model policies automatically.

Account availability stays in memory, separate from the six-hour model cache. Until discovery succeeds, catalog entries remain visible; failed refreshes retain the previous snapshot. Background discovery does not execute command-backed credentials. Restart zot after changing accounts. Filtering helps model selection but does not grant or enforce access; GitHub still authorizes every request.

Sonnet 4.5 was retired on September 1, 2026. Sonnet 4.6 was also retired except for individual annual Copilot Pro and Pro+ subscribers. It is excluded from the general catalog; eligible subscribers can add it through $ZOT_HOME/models.json. MAI-Code-1-Flash uses mai-code-1-flash-picker and is scheduled to retire on September 10, 2026. Prefer mai-code-1.1-flash for new configurations. GPT-5.4 nano is not a Copilot Chat choice; GitHub offers it through the Codex VS Code extension.

For current availability, retirement dates, plan exceptions, and retention terms, see https://docs.github.com/en/copilot/reference/ai-models/supported-models.

The routing and availability filtering described here are available on runtime main from commit 6abb410; older builds may still use the previous catalog and routing.

API-key providers

Simple API-key providers can be configured through /login or environment variables. Examples include Anthropic, OpenAI, OpenAI Responses, DeepSeek, Google Gemini, Kimi/Moonshot, Moonshot CN, Groq, Cerebras, xAI, Together AI, Hugging Face Router, OpenRouter, Mistral, Z.AI, Xiaomi/MiMo, MiniMax, Fireworks, Vercel AI Gateway, and OpenCode.

API keys from commands

To keep an API key in a password manager instead of storing it directly in auth.json, configure an api_key_command for the provider:

{
  "anthropic": {
    "api_key_command": {
      "program": "op",
      "args": ["read", "op://Work/Anthropic/credential"],
      "timeout_ms": 120000
    }
  }
}

For providers without a dedicated top-level entry, including providers added through models.json, put the same credential object under additional_api_key_creds using the provider ID. program runs directly without a shell, and every argument must be a separate args entry. timeout_ms is optional and defaults to 120 seconds.

zot runs the command only when that provider is selected. Login-status checks and background model discovery do not execute it. Successful output is cached in memory until zot exits and is never written back to disk. Swarm sub-agents inherit the resolved credential from the supervisor over stdin, so concurrent children do not rerun the command and the credential is not placed in child arguments or environment variables. The command must print one non-empty line to stdout; trailing CR/LF characters are removed and output is limited to 64 KiB. Saving a normal key through /login replaces the command, and /logout removes it.

Cloud setup providers

These providers need more than a single pasted key, so /login shows setup instructions and points to the provider reference instead of starting a local web login flow.

Amazon Bedrock

Bedrock API keys are bearer tokens. Set AWS_BEARER_TOKEN_BEDROCK and AWS_REGION, or use the standard AWS credential chain with AWS_PROFILE, IAM access keys, ECS task roles, or IRSA.

export AWS_BEARER_TOKEN_BEDROCK=bedrock-api-key-...
export AWS_REGION=us-east-1
zot --provider amazon-bedrock --model anthropic.claude-sonnet-4-5-20250929-v1:0

Some Bedrock models require regional inference-profile IDs for on-demand throughput, such as us. or eu. prefixed model IDs. zot rewrites known families automatically where possible, while explicit profile IDs and ARNs are left unchanged.

Custom and local providers

• Local/compatible: Ollama and generic OpenAI-compatible endpoints via --base-url.
• Managed GGUF models: connect the distinct llama.cpp provider to a recent llama.cpp router, then use /llama for download, load, unload, and removal.
• Named custom providers: define a new provider key with its own baseUrl and api format in $ZOT_HOME/models.json. It logs in through /login and reads a derived env var such as MY_COMPANY_API_KEY.
• Private model IDs, deployment aliases, and provider overrides live in $ZOT_HOME/models.json.

llama.cpp router

zot has first-class support for llama.cpp router mode. This is separate from Ollama and from a single-model llama.cpp server. The router exposes model management endpoints, while inference uses its OpenAI-compatible /v1 API.

mkdir -p ~/llama-models

llama-server \
  --models-dir ~/llama-models \
  --no-models-autoload \
  --jinja \
  --host 127.0.0.1 \
  --port 8080 \
  -ngl 999 \
  -c 32768

Start the router without --model, -m, or -hf. Verify that GET /health and GET /models work, then run /login, choose api key, select llama.cpp, and enter http://127.0.0.1:8080 without /v1. The optional API key must match the router's --api-key value.

export LLAMA_BASE_URL=http://127.0.0.1:8080
export LLAMA_API_KEY=optional-secret

• Open /llama to inspect router model state and search Hugging Face GGUF repositories.
• Choose a quantization, download it with live byte and percentage progress, and explicitly load or unload it.
• Press d on a router-downloaded cache model to ask the router to remove it after confirmation.
• Open /model to refresh and select currently loaded llama.cpp models. Unloaded models are intentionally omitted.

See the models page for the full custom-provider schema, credential handling, and the --insecure TLS option.

The model picker only shows models from providers currently available through env vars, $ZOT_HOME/auth.json, Kimi CLI fallback, local Ollama, or loaded models from a configured llama.cpp router.