Set up provider credentials
Authenticate Anthropic, OpenAI, and xAI without putting secrets in commands or model prompts.
AFK needs credentials for a hosted model, but a local OpenAI-compatible server may accept a placeholder key. Choose the provider you intend to use, then run afk doctor or afk provider auth diagnose to check which credential source AFK selected.
Anthropic
afk login in a terminal and enter an Anthropic API key or existing OAuth token at the masked prompt. This command does not open a browser OAuth flow.afk login stores an sk-ant-oat token as CLAUDE_CODE_OAUTH_TOKEN, or other input as ANTHROPIC_API_KEY, in ~/.afk/config/afk.env. It removes a stale value of the other type. Anthropic resolution prefers ANTHROPIC_API_KEY, then CLAUDE_CODE_OAUTH_TOKEN, then available Keychain OAuth state. You can instead set ANTHROPIC_API_KEY in the process environment or enter it through afk config env set ANTHROPIC_API_KEY (masked prompt). Do not put a key inline in a shell command.
OpenAI and ChatGPT subscription
For OpenAI API billing, use the masked afk config env set OPENAI_API_KEY prompt or an existing shell environment variable. afk login is for Anthropic credentials; it does not log into OpenAI. For a ChatGPT subscription, authenticate with the Codex CLI first:
codex login
afk chat --model gpt-5.6-terra "Hello"OpenAI-compatible auth checks in this order: explicit per-session or per-slot API key, OPENAI_API_KEY, legacy CODEX_API_KEY, then an API key in ~/.codex/auth.json, then a ChatGPT OAuth access token in that file as the last resort. An explicit slot binding with provider: "chatgpt-oauth" forces the ChatGPT token for that slot even when an API key exists. AFK reads Codex OAuth state but does not refresh its token; renew it with codex login when it expires. The subscription OAuth path uses the Responses API, which may not support every model or endpoint.
xAI
Use afk config env set XAI_API_KEY for metered Grok API access. Alternatively, run afk provider auth xai login for SuperGrok OAuth. If both an API key and OAuth token exist for an unforced Grok model, AFK reports ambiguous auth rather than silently choosing one; bind a slot to provider: "xai" or provider: "xai-oauth" to select a mode. xAI does not borrow OPENAI_API_KEY. See Models and providers.
Other credentials
Telegram uses TELEGRAM_BOT_TOKEN plus an allowed-chat list, configured through afk telegram setup. Web search uses EXA_API_KEY for web_scrape search mode; ordinary markdown or raw fetch does not need Exa. Local OpenAI-compatible shims often accept a nonsecret placeholder key with AFK_OPENAI_BASE_URL.
Saved browser profile state and provider tokens are credentials. Keep them out of committed JSON, screenshots, logs, and pasted prompts. The agent's config_get masks secret values, and config_set refuses credential writes.