Connect a provider without exposing its key

`vidbyte-cli provider login` accepts the seven provider identifiers listed below. The CLI validates the provider-specific key format, probes that provider's models endpoint, and only then stores the credential.

1. Every provider accepted by provider login

Use the CLI identifier in the first column as the `<provider>` argument. Environment variables are resolution inputs, not command arguments. A provider key stored by login is scoped to the selected profile and provider, so it does not collide with the Vidbyte API key.

Provider	CLI identifier	Environment variable	Key format	Verification endpoint
OpenAI	openai	OPENAI_API_KEY	Starts with sk- (not sk-ant-)	api.openai.com/v1/models
Claude	claude	ANTHROPIC_API_KEY	Starts with sk-ant-	api.anthropic.com/v1/models
Grok	grok	XAI_API_KEY	Opaque; any non-empty key	api.x.ai/v1/models
DeepSeek	deepseek	DEEPSEEK_API_KEY	Starts with sk-	api.deepseek.com/v1/models
GLM	glm	ZAI_API_KEY	Opaque; any non-empty key	api.z.ai/api/paas/v4/models
Muse	muse	MODEL_API_KEY	Starts with LLM\|	api.meta.ai/v1/models
Gemini	gemini	GOOGLE_API_KEY or GEMINI_API_KEY	Starts with AIza	generativelanguage.googleapis.com/v1beta/models

Gemini checks GOOGLE_API_KEY first, then GEMINI_API_KEY. The CLI sends each provider's documented native authentication header during verification and does not display the secret.

2. Verification happens before persistence

Interactive login reads a key from a hidden prompt. The CLI strips surrounding whitespace, rejects an empty or provider-mismatched value, and performs a bounded GET against the provider's models endpoint. A rejected or malformed key never reaches the credential store.

When verification succeeds, the CLI writes to the OS keyring when one is available. If no OS keyring exists, a restricted local-file fallback requires explicit consent; this fallback is not selected silently.

Provider credentials and your Vidbyte API key are different secrets. The provider credential pays for model usage in local runtimes; the Vidbyte key authenticates your account and ownership of the CLI request.

3. Choose a safe login mode

Use the hidden prompt for a person at a terminal. Use `--with-token` when a script or CI job can pipe the secret through stdin. If the machine has no OS keyring, add `--allow-file-fallback` only when you have reviewed the local file permissions and accept that processes running as your user can read the file.

Shell

Interactive and scripted provider login

# Hidden prompt
vidbyte-cli provider login openai

# Read from stdin; the key does not appear in the command line
printf '%s\n' "$OPENAI_API_KEY" | vidbyte-cli --no-input provider login openai --with-token

# Explicitly approve restricted-file fallback when no OS keyring exists
vidbyte-cli provider login gemini --allow-file-fallback

4. Inspect or remove a stored provider key

`provider whoami` resolves the credential for the selected profile and re-probes the provider, reporting the provider, profile, verification result, and non-secret credential source. `provider logout` clears that provider from both the keyring and the restricted-file fallback.