Providers

kprompt does not sell API keys. For NL plans use local Ollama ($0, no key) via kprompt init --ollama, or BYOK with kprompt init --provider … plus your own cloud key. Requests go from your machine to that provider; there is no kprompt-hosted inference proxy. With no provider configured, the CLI stays unconfigured (no silent OpenAI default). Provider keys are environment variables only and are never written to the config file. Optional Team kp_… tokens are for org policy/audit, not LLM inference.

Supported providers

Ollama runs locally at http://127.0.0.1:11434/v1 and needs no key — the $0 path for trying kprompt or running it in CI. LM Studio is the same local OpenAI-compatible shape at http://127.0.0.1:1234/v1; start the app, load a model, and pass --model with that model's name. Groq, xAI (Grok), Cerebras, Mistral, DeepSeek, Moonshot (Kimi K3), Qwen (DashScope), OpenRouter, Together, Fireworks, and Hetzner Inference all speak the OpenAI-compatible API. Fireworks model ids are account-scoped (accounts/fireworks/models/…). Hetzner Inference is experimental (free while in beta, no SLA). The qwen preset defaults to the international DashScope endpoint; mainland China keys need KPROMPT_OPENAI_BASE_URL pointed at the CN compatible-mode URL. Azure OpenAI uses the named azure preset with a resource base_url; --model is your deployment name.

Gemini free tier (honest)

AI Studio keys often start on a free tier with daily / per-minute quotas. Exceeding them returns HTTP 429 — Google’s limit, not a kprompt bug. Get a key at aistudio.google.com/apikey. Monitor quotas at ai.dev/rate-limit.

export KPROMPT_GEMINI_API_KEY=...
kprompt config set provider gemini
kprompt config set model gemini-3.6-flash   # current GA Flash

Prefer Ollama when you want $0 with no cloud quota. Team bridge failures: App runs & CLI bridge.

How keys are resolved

• Ollama and LM Studio need no provider key
• The KPROMPT_-prefixed variable is checked first, then the vendor default such as OPENAI_API_KEY
• Environment variables always win over keys pulled from a Team org with kprompt secrets pull
• ~/.kprompt/config.yaml stores provider, model, namespace, and base_url — never a key
• kprompt doctor reports whether a usable key was found without printing its value
• Team kp_… tokens from kprompt login are unrelated to LLM provider keys

Examples

# Local Ollama ($0)
kprompt --provider ollama --model llama3.2 "list pods"

# LM Studio (local $0 — start the server and load a model first)
kprompt --provider lmstudio --model <loaded-model-name> "list pods"

export KPROMPT_OPENAI_API_KEY=sk-...
kprompt "list deployments"

export KPROMPT_ANTHROPIC_API_KEY=sk-ant-...
kprompt --provider anthropic "explain why api is crashing"

export KPROMPT_GEMINI_API_KEY=...
kprompt --provider gemini --model gemini-3.6-flash "deploy redis"

export KPROMPT_XAI_API_KEY=...
kprompt --provider xai "explain why api is crashlooping"

export KPROMPT_MOONSHOT_API_KEY=...
kprompt --provider moonshot "explain why api is crashlooping"

export KPROMPT_QWEN_API_KEY=...
kprompt --provider qwen "explain why api is crashlooping"

# Hetzner Inference (experimental — free while in beta)
export KPROMPT_HETZNER_API_KEY=...
kprompt --provider hetzner "list pods"

Azure OpenAI and custom gateways

Azure OpenAI has a named azure preset (still OpenAI-compatible under the hood). Set the resource URL as base_url; --model is the deployment name you created in the portal — not an OpenAI model id. Generic gateways keep using openai-compatible.

export KPROMPT_AZURE_API_KEY=...
export KPROMPT_OPENAI_BASE_URL=https://YOUR_RESOURCE.openai.azure.com/openai/v1
kprompt --provider azure --model my-gpt4o-deploy "list services"

# or any OpenAI-compatible gateway
export KPROMPT_OPENAI_API_KEY=...
export KPROMPT_OPENAI_BASE_URL=https://gateway.example/v1
kprompt --provider openai-compatible --model gpt-4o-mini "list services"

Config file

provider: ollama
model: llama3.2
# provider: gemini
# model: gemini-3.6-flash
# base_url: https://api.groq.com/openai/v1   # optional override
namespace: default

kprompt config set provider ollama
kprompt config set model llama3.2
kprompt config

Choosing a model

• Start with local Ollama ($0) for first NL plans — no cloud key to buy
• Fast and cheap cloud models handle routine intents like list, scale, and logs well
• Reserve a stronger model for explain, investigate, and why prompts that reason across events and logs
• Local Ollama models avoid all spend but produce weaker plans on ambiguous prompts
• Switch per command with --provider and --model without changing your saved defaults

Model choice affects plan quality, never the approval boundary: a weaker model may produce a worse plan, but it still cannot bypass the safety engine or apply without approval.