API keys

Where the key comes from. Checked in order; the first one that answers wins.

1. api_key in axon's providers.json — a leading $ reads that environment variable at startup, so you never commit the key itself.
2. The LLM_API_KEY environment variable.
3. ~/.config/agent/providers.json, matched on the provider name — the shared file the axon-family tools already use. Override its path withAXON_PROVIDERS_PATH.

The third exists so a key has one home on disk. If you already keep credentials in providers.json, omit the key from your cortex config entirely and cortex will find it:

{ "providers": [
    { "name": "openrouter", "base_url": "https://openrouter.ai/api", "api_key": "sk-or-..." }
] }

cortex reads only name and api_key from that file; the model lists and routing options in it belong to other tools and are ignored.

Local endpoints need no key

A localhost endpoint (e.g. ollama running locally) needs no API key. PointLLM_BASE_URL at it and leave the key unset.

The leading $

Wherever a config accepts an api_key value, a leading $ reads the rest as an environment variable name and substitutes its value at startup. This keeps the literal key out of your config file:

{ "providers": [
    { "name": "openai", "api_key": "$OPENAI_API_KEY" }
] }