Providers

zot ships a broad provider catalog so /login, /model, --provider, and --list-models all speak the same IDs.

Use /login for subscription auth and simple API-key providers. Providers that need cloud-specific settings show setup guidance instead of opening a localhost browser form, which is safer for SSH, containers, and kubectl exec sessions.

HTTP proxy

Set one global proxy for zot-managed HTTP and HTTPS traffic with http_proxy in $ZOT_HOME/config.json:

{
  "http_proxy": "http://127.0.0.1:7890"
}

zot applies the setting at startup. Existing HTTP_PROXY, HTTPS_PROXY, http_proxy, and https_proxy environment variables take precedence for their corresponding protocol. NO_PROXY and no_proxy continue to control bypasses. Restart zot after changing the setting.

Subscription login

Anthropic Claude Pro/Max (anthropic), OpenAI Codex / ChatGPT Plus/Pro (openai-codex), Kimi Code (kimi), xAI SuperGrok / X Premium (xai), and GitHub Copilot (github-copilot). OAuth tokens are stored in $ZOT_HOME/auth.json and refreshed when supported.

For Anthropic, choose a browser callback or a separate copy-code flow before starting login. The copy-code flow uses Anthropic's hosted redirect and does not need a local callback port. The browser flow uses localhost:53692 and also accepts a pasted code or final redirect URL from the same authorization link.

OpenAI uses a browser callback on localhost:1455. You can also paste the code or final redirect URL from that same authorization link. If your browser is on another machine, copy the final redirect URL from its address bar even if the page cannot load. The callback port must still be available on the machine running zot. zot checks a pasted state against the active login transaction. Kimi, xAI, and GitHub Copilot use device-code login instead.

GitHub Copilot

Use /login with github-copilot, or supply a GitHub token with Copilot access through COPILOT_GITHUB_TOKEN or GITHUB_COPILOT_TOKEN. The default model is claude-sonnet-5:

zot --provider github-copilot --model claude-sonnet-5

zot selects the wire protocol automatically. Claude uses Anthropic Messages with Copilot Bearer authentication, without Claude Code identity injection. GPT, Grok, and MAI use Responses. Gemini and Kimi use Chat Completions without reasoning_effort; their reasoning is managed by the endpoint. Requests include user/agent initiator metadata and image-request headers where appropriate.

At startup, zot queries Copilot's authenticated /models endpoint in the background. The runtime picker is filtered by model-picker visibility, policy state, and tool-call support. Individual accounts with no eligible picker entries can fall back to explicitly enabled policies; other account types cannot. zot never enables model policies automatically.

Account availability stays in memory, separate from the six-hour model cache. Until discovery succeeds, catalog entries remain visible; failed refreshes retain the previous snapshot. Background discovery does not execute command-backed credentials. Restart zot after changing accounts. Filtering helps model selection but does not grant or enforce access; GitHub still authorizes every request.

Sonnet 4.5 was retired on September 1, 2026. Sonnet 4.6 was also retired except for individual annual Copilot Pro and Pro+ subscribers. It is excluded from the general catalog; eligible subscribers can add it through $ZOT_HOME/models.json. MAI-Code-1-Flash uses mai-code-1-flash-picker and is scheduled to retire on September 10, 2026. Prefer mai-code-1.1-flash for new configurations. GPT-5.4 nano is not a Copilot Chat choice; GitHub offers it through the Codex VS Code extension.

For current availability, retirement dates, plan exceptions, and retention terms, see https://docs.github.com/en/copilot/reference/ai-models/supported-models.

The routing and availability filtering described here are available on runtime main from commit 6abb410; older builds may still use the previous catalog and routing.

API-key providers

Simple API-key providers can be configured through /login or environment variables. Examples include Anthropic, OpenAI, OpenAI Responses, DeepSeek, Google Gemini, Kimi/Moonshot, Moonshot CN, Groq, Cerebras, xAI, Together AI, Hugging Face Router, OpenRouter, Mistral, Z.AI, Xiaomi/MiMo, MiniMax, Fireworks, Vercel AI Gateway, and OpenCode.

API keys from commands

To keep an API key in a password manager instead of storing it directly in auth.json, configure an api_key_command for the provider:

{
  "anthropic": {
    "api_key_command": {
      "program": "op",
      "args": ["read", "op://Work/Anthropic/credential"],
      "timeout_ms": 120000
    }
  }
}

For providers without a dedicated top-level entry, including providers added through models.json, put the same credential object under additional_api_key_creds using the provider ID. program runs directly without a shell, and every argument must be a separate args entry. timeout_ms is optional and defaults to 120 seconds.

zot runs the command only when that provider is selected. Login-status checks and background model discovery do not execute it. Successful output is cached in memory until zot exits and is never written back to disk. Swarm sub-agents inherit the resolved credential from the supervisor over stdin, so concurrent children do not rerun the command and the credential is not placed in child arguments or environment variables. The command must print one non-empty line to stdout; trailing CR/LF characters are removed and output is limited to 64 KiB. Saving a normal key through /login replaces the command, and /logout removes it.

Cloud setup providers

These providers need more than a single pasted key, so /login shows setup instructions and points to the provider reference instead of starting a local web login flow.

Amazon Bedrock

Bedrock API keys are bearer tokens. Set AWS_BEARER_TOKEN_BEDROCK and AWS_REGION, or use the standard AWS credential chain with AWS_PROFILE, IAM access keys, ECS task roles, or IRSA.

export AWS_BEARER_TOKEN_BEDROCK=bedrock-api-key-...
export AWS_REGION=us-east-1
zot --provider amazon-bedrock --model anthropic.claude-sonnet-4-5-20250929-v1:0

Some Bedrock models require regional inference-profile IDs for on-demand throughput, such as us. or eu. prefixed model IDs. zot rewrites known families automatically where possible, while explicit profile IDs and ARNs are left unchanged.

Custom and local providers

• Local/compatible: Ollama and generic OpenAI-compatible endpoints via --base-url.
• LM Studio: register a server URL through /login to discover local models automatically. No server is probed before registration.
• Managed GGUF models: connect the distinct llama.cpp provider to a recent llama.cpp router, then use /llama for download, load, unload, and removal.
• Named custom providers: define a new provider key with its own baseUrl and api format in $ZOT_HOME/models.json. It logs in through /login and reads a derived env var such as MY_COMPANY_API_KEY. Add "discover": true to list its models live from the OpenAI-compatible /models endpoint; see Models for details.
• Private model IDs, deployment aliases, and provider overrides live in $ZOT_HOME/models.json.

One gateway with multiple API formats

Define a separate custom provider for each wire format a gateway exposes. The api setting belongs to the provider entry, not to an individual model. zot does not choose a custom provider's wire format from a model ID. For example, A2Agent exposes Chat Completions, Responses, and Anthropic Messages at different paths:

{
  "providers": {
    "a2agent-chat": {
      "baseUrl": "https://a2agent.me/v1",
      "api": "openai",
      "models": [{ "id": "YOUR_CHAT_MODEL_ID" }]
    },
    "a2agent-responses": {
      "baseUrl": "https://a2agent.me/v1",
      "api": "openai-responses",
      "models": [{ "id": "YOUR_RESPONSES_MODEL_ID" }]
    },
    "a2agent-messages": {
      "baseUrl": "https://a2agent.me",
      "api": "anthropic",
      "models": [{ "id": "YOUR_MESSAGES_MODEL_ID" }]
    }
  }
}

Use model IDs available to your key and supported by the chosen API format. The Anthropic entry uses the site root because zot appends /v1/messages. The other entries use /v1, producing /v1/chat/completions and /v1/responses respectively.

Set the corresponding A2AGENT_CHAT_API_KEY, A2AGENT_RESPONSES_API_KEY, or A2AGENT_MESSAGES_API_KEY environment variable to an A2Agent key before selecting that entry. The same key can be used for multiple entries if its group permits the models and formats. Then select the matching provider and replace the placeholder model ID:

zot --provider a2agent-chat --model YOUR_CHAT_MODEL_ID

LM Studio

Open /login, choose api key, select LM Studio, and enter the server URL, for example http://localhost:1234. Enter an API key if the server requires one, otherwise leave it empty. Zot stores this connection under lmstudio in $ZOT_HOME/auth.json.

The server URL is required. Zot does not scan localhost, and an API key alone does not enable discovery. Registration leaves your current provider and model selected.

After registration, open /model to refresh and select a discovered model. Zot also refreshes after saving the connection, in the background on startup, and when selecting or resuming an LM Studio model. You can select a model directly after registration:

zot --provider lmstudio --model my-local-model

Discovery prefers /api/v1/models and falls back to /v1/models when the native endpoint returns 404, 405, or 501. It lists models without loading or downloading them. Inference with an unloaded model depends on LM Studio's auto-loading settings. There is no /llama-style model-management interface for LM Studio.

The discovered list stays in memory, separate from the six-hour cloud model cache and llama.cpp's model list. A failed refresh retains the previous snapshot, and /model reports the error while keeping other providers accessible. /logout lmstudio removes the connection and stops discovery. Background refresh never executes API-key commands.

See Models for context limits, defaults, and metadata overrides. The existing coding loop, tools, permissions, and built-in provider pricing do not change.

llama.cpp router

zot has first-class support for llama.cpp router mode. This is separate from Ollama and from a single-model llama.cpp server. The router exposes model management endpoints, while inference uses its OpenAI-compatible /v1 API.

mkdir -p ~/llama-models

llama-server \
  --models-dir ~/llama-models \
  --no-models-autoload \
  --jinja \
  --host 127.0.0.1 \
  --port 8080 \
  -ngl 999 \
  -c 32768

Start the router without --model, -m, or -hf. Verify that GET /health and GET /models work, then run /login, choose api key, select llama.cpp, and enter http://127.0.0.1:8080 without /v1. The optional API key must match the router's --api-key value.

export LLAMA_BASE_URL=http://127.0.0.1:8080
export LLAMA_API_KEY=optional-secret

• Open /llama to inspect router model state and search Hugging Face GGUF repositories.
• Choose a quantization, download it with live byte and percentage progress, and explicitly load or unload it.
• Press d on a router-downloaded cache model to ask the router to remove it after confirmation.
• Open /model to refresh and select currently loaded llama.cpp models. Unloaded models are intentionally omitted.

See the models page for the full custom-provider schema, credential handling, and the --insecure TLS option.

The model picker only shows models from providers currently available through env vars, $ZOT_HOME/auth.json, Kimi CLI fallback, local Ollama, a registered LM Studio server, or loaded models from a configured llama.cpp router.