Bug Description

🐛 Bug: "Custom endpoint" doesn't isolate its API key from other providers

@Teknium — found an issue in provider key resolution that probably hits anyone who tried OpenRouter first and then switched to a custom endpoint.

The problem:
When you select "Custom endpoint" via hermes model and configure OPENAI_API_KEY + OPENAI_BASE_URL in .env to point at Z.ai (or any OpenAI-compatible provider), Hermes still picks up OPENROUTER_API_KEY from the same .env and sends THAT as the Authorization header to your custom URL. You get a cryptic 400 with an empty body — no error message, nothing to debug.

Why this matters:
The natural onboarding flow is: start with OpenRouter → decide to switch to Z.ai/vLLM/custom → select "Custom endpoint" → set your new key. But the old OPENROUTER_API_KEY from step 1 is still in .env (as it should be — you might want to switch back). Current logic lets it silently override the custom endpoint's auth.

Steps to Reproduce

Steps to reproduce:

1. Set up Hermes with OpenRouter (adds OPENROUTER_API_KEY to .env)
2. hermes model → switch to "Custom endpoint"
3. Add OPENAI_BASE_URL=https://api.z.ai/api/coding/paas/v4 to .env
4. Add OPENAI_API_KEY=<your-zai-key> to .env
5. hermes → 400 error. Request dump confirms OpenRouter key sent to Z.ai URL

Expected Behavior

When provider is set to "Custom endpoint", Hermes should ONLY use OPENAI_API_KEY / OPENAI_BASE_URL. Other provider keys (OPENROUTER_API_KEY, NOUS_API_KEY, etc.) should be ignored for the auth header — they may still be needed for other tools (vision, TTS, etc.) but shouldn't leak into the LLM provider.

Actual Behavior

-> 400 bad request

Affected Component

Configuration (config.yaml, .env, hermes setup)

Messaging Platform (if gateway-related)

N/A (CLI only)

Operating System

mac os

Python Version

3.11.5

Hermes Version

Hermes Agent vv1.0.0

Relevant Logs / Traceback

Root Cause Analysis (optional)

Current workaround: Comment out OPENROUTER_API_KEY in .env — but this shouldn't be necessary.

Confirmed: Z.ai coding plan + GLM-5 with full 31 tools + 24K char system prompt works perfectly once the correct key reaches the endpoint. The payload, tools, and format are all fine — it's purely the wrong key being sent.

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

• I'd like to fix this myself and submit a PR