Providers & BYOK

Pytxo separates two forms of access that are often confused:

1. Vendor-owned agent sessions — Codex CLI, Claude Code, Cursor Agent, OpenCode, Gemini CLI, or Aider authenticate with their own vendor flow.
2. Direct inference credentials — OpenAI, Anthropic, DeepSeek, OpenRouter, local Ollama / LM Studio, and other providers use BYOK routing.

Pytxo never asks for a ChatGPT or Claude password, copies a vendor token store, or returns account identity and token values to the Desktop webview.

Agent subscription sessions

Desktop Agents checks whether supported agent CLIs are installed and whether their non-billable local status probe reports a usable session. When a session is missing, Sign in launches the CLI's fixed official login command from a host-safe directory.

These sessions remain owned by the vendor CLI. Pytxo does not log users out or silently exchange them for API billing.

Direct providers

Use direct provider APIs, a single OpenRouter key, local Ollama / LM Studio, or custom OpenAI-compatible endpoints without storing secrets in pytxo.toml.

Check configured providers

pytxo providers              # registry + whether each API key env is set (boolean only)
pytxo providers --json       # includes base URLs when known

Desktop: Setup → Providers shows the same status and names the environment variable to configure. Set it in the operating-system environment, restart Desktop, and refresh the panel. The UI receives only boolean readiness metadata, never key values.

Fast path: OpenRouter

One key unlocks hundreds of models for generic OpenAI-compat CLIs:

export OPENROUTER_API_KEY=sk-or-...
pytxo models search claude --provider openrouter

Environment variables

For Azure, set both the key and AZURE_OPENAI_ENDPOINT (resource root or full .../openai/v1 URL).

Ultra managed mode strips registered BYOK keys from child environments.

Custom providers (~/.pytxo/providers.json)

Add OpenAI-compatible endpoints without waiting for a Pytxo release:

{
  "providers": [
    {
      "id": "my-proxy",
      "display_name": "My proxy",
      "api_key_env": "MY_PROXY_API_KEY",
      "openai_base_url": "https://llm.example.com/v1",
      "models_url": "https://llm.example.com/v1/models",
      "openai_compatible": true
    }
  ]
}

Then route an agent with provider = "my-proxy" and cli_adapter = "generic".

pytxo.toml agent routing

[[agent]]
name = "builder"
model = "deepseek-chat"
provider = "deepseek"
cli_adapter = "generic"
api_key_env = "DEEPSEEK_API_KEY"   # optional override

OpenRouter gateway:

[[agent]]
name = "router"
model = "anthropic/claude-3.5-sonnet"
provider = "openrouter"
cli_adapter = "generic"

Native agent CLIs keep their own session and environment contracts. Before a child starts, Pytxo rebuilds its environment from an allowlist and injects only the provider route selected for that agent. Unrelated parent-process secrets are excluded from both PTY and subprocess execution.

See also: Models CLI, pytxo.toml.