Add an API key

Nothing in Erebros needs a key to boot. Each provider turns on when its key is present, and stays off — visibly, with the variable it wants — when it is not. This guide adds one key and verifies it, using Kimi as the example.

1. Get the key

Create a key at the provider’s console — for Kimi, platform.moonshot.ai/console. Every app page in these docs names its variable and where to get the key under What it needs; the full list is on Configuration.

2. Add it in Settings → Secrets

Open the gear in the sidebar footer → Secrets. Find KIMI_API_KEY, paste the value, save. The panel writes .env.local for you and applies the change at once; the value is shown masked from then on, and you can rotate or remove it here later.

Prefer the file? Edit .env.local in the install folder:

KIMI_API_KEY=sk-...

Then restart — the file is read only at startup (systemctl --user restart erebros, or stop and start npm run dev).

3. Check it lit up

The sidebar dot next to Kimi turns on and reads Moonshot K2 API.
In Chat, the Kimi engine is no longer greyed out.
Health lists the provider as OK.

If it stays off: confirm the variable name (the greyed-out engine prints it), that there is no stray quote or space, and that you restarted after a file edit.

Keys that are not keys

Claude, Grok, Codex, Antigravity, Qwen Code, Hermes, OpenClaw, OpenCode and Ollama use their own logins — run the CLI once in a terminal (or claude setup-token on a headless server) and Erebros finds it on PATH. Z.AI is pasted from the Chat account panel, which verifies it before storing it as ZAI_API_KEY.

Where a key is allowed to go

Keys stay on this machine: .env.local is 0600, never shipped in a release zip, and never reaches the browser. Agents spawned by Erebros receive only the variables they need. See Security & remote access.