fix(setup): save API key to model config for custom endpoints by dieutx · Pull Request #4182 · NousResearch/hermes-agent

dieutx · 2026-03-31T06:21:54Z

Summary

After the config refactor (#4165), setting up a new custom cloud endpoint (Together.ai, RunPod, Groq direct, etc.) silently loses the API key. Hermes sends requests with no authentication and the user gets 401/403 errors.

Existing users are unaffected because their old .env files still have OPENAI_API_KEY. Only fresh setups after the refactor hit this.

Root Cause

_model_flow_custom() saves model.provider = "custom" and model.base_url to config.yaml (line 1275-1276) but not the API key. The key is only saved to the custom_providers list via _save_custom_provider().

At runtime, _get_named_custom_provider() in runtime_provider.py:133 rejects plain "custom" — it only handles custom:<name> patterns. So the custom_providers list is never consulted and the stored key is unreachable.

The resolution chain falls through to checking os.getenv("OPENAI_API_KEY") which is empty (the refactor removed the .env save), then _ensure_runtime_credentials() silently replaces the empty key with "no-key-required".

_model_flow_custom saves: model.provider="custom", model.base_url="https://api.together.ai/v1"
                          custom_providers[0].api_key="sk-xxx" (unreachable)
                          model.api_key → NOT SAVED

runtime resolves: _get_named_custom_provider("custom") → None (rejects plain "custom")
                  os.getenv("OPENAI_API_KEY") → empty
                  → "no-key-required" → 401

Fix

Save model.api_key to config alongside model.provider and model.base_url:

if effective_key:
    model["api_key"] = effective_key

One line, consistent with how model.provider and model.base_url are already saved.

Note: #4180 fixes a different issue in the same flow (wizard overwriting config on final save). This fix addresses the runtime key resolution gap.

teknium1 · 2026-03-31T08:31:00Z

Reviewing!

Custom cloud endpoints (Together.ai, RunPod, Groq, etc.) lost their API key after #4165 removed OPENAI_API_KEY .env saves. The key was only saved to the custom_providers list which is unreachable at runtime for plain 'custom' provider resolution. Save model.api_key to config.yaml alongside model.provider and model.base_url in all three custom endpoint code paths: - _model_flow_custom (new endpoint with model name) - _model_flow_custom (new endpoint without model name) - _model_flow_named_custom (switching to a saved endpoint) The runtime resolver already reads model.api_key (runtime_provider.py line 224-228), so the key is picked up automatically. Each custom endpoint carries its own key in config — no shared OPENAI_API_KEY env var needed.

Custom endpoint setup (_model_flow_custom) now probes the server first and presents detected models instead of asking users to type blind: - Single model: auto-confirms with Y/n prompt - Multiple models: numbered list picker, or type a name - No models / probe failed: falls back to manual input Context length prompt also moved after model selection so the user sees the verified endpoint before being asked for details. All recent fixes preserved: config dict sync (#4172), api_key persistence (#4182), no save_env_value for URLs (#4165). Inspired by PR #4194 by sudoingX — re-implemented against current main.

…4218) Custom endpoint setup (_model_flow_custom) now probes the server first and presents detected models instead of asking users to type blind: - Single model: auto-confirms with Y/n prompt - Multiple models: numbered list picker, or type a name - No models / probe failed: falls back to manual input Context length prompt also moved after model selection so the user sees the verified endpoint before being asked for details. All recent fixes preserved: config dict sync (#4172), api_key persistence (#4182), no save_env_value for URLs (#4165). Inspired by PR #4194 by sudoingX — re-implemented against current main. Co-authored-by: Xpress AI (Dip KD) <200180104+sudoingX@users.noreply.github.com>

…4182) Custom cloud endpoints (Together.ai, RunPod, Groq, etc.) lost their API key after NousResearch#4165 removed OPENAI_API_KEY .env saves. The key was only saved to the custom_providers list which is unreachable at runtime for plain 'custom' provider resolution. Save model.api_key to config.yaml alongside model.provider and model.base_url in all three custom endpoint code paths: - _model_flow_custom (new endpoint with model name) - _model_flow_custom (new endpoint without model name) - _model_flow_named_custom (switching to a saved endpoint) The runtime resolver already reads model.api_key (runtime_provider.py line 224-228), so the key is picked up automatically. Each custom endpoint carries its own key in config — no shared OPENAI_API_KEY env var needed.

…ousResearch#4218) Custom endpoint setup (_model_flow_custom) now probes the server first and presents detected models instead of asking users to type blind: - Single model: auto-confirms with Y/n prompt - Multiple models: numbered list picker, or type a name - No models / probe failed: falls back to manual input Context length prompt also moved after model selection so the user sees the verified endpoint before being asked for details. All recent fixes preserved: config dict sync (NousResearch#4172), api_key persistence (NousResearch#4182), no save_env_value for URLs (NousResearch#4165). Inspired by PR NousResearch#4194 by sudoingX — re-implemented against current main. Co-authored-by: Xpress AI (Dip KD) <200180104+sudoingX@users.noreply.github.com>

Custom endpoint setup (_model_flow_custom) now probes the server first and presents detected models instead of asking users to type blind: - Single model: auto-confirms with Y/n prompt - Multiple models: numbered list picker, or type a name - No models / probe failed: falls back to manual input Context length prompt also moved after model selection so the user sees the verified endpoint before being asked for details. All recent fixes preserved: config dict sync (NousResearch#4172), api_key persistence (NousResearch#4182), no save_env_value for URLs (NousResearch#4165). Inspired by PR NousResearch#4194 by sudoingX — re-implemented against current main.