Skip to main content

Models and billing

AgentD brings no model access of its own. Claude Code and Codex call their models as each is configured, and Chat calls the gateway set under [gateway]. You can:

  • keep your own Claude or ChatGPT sign-in, or your own provider key, billed by that provider; or
  • point Chat and either client at the LibraOS model API with a model API key from the Console's API keys page. One balance, or your Token Plan, pays for both, at the prices on Credits & billing. See Credits and billing.

Store the key​

Save the lk_… key alone in a file only you can read:

mkdir -p ~/.config/agentd
install -m 600 /dev/null ~/.config/agentd/libraos.key
# paste the key into the file with your editor; do not put it in shell history

AgentD reads a key file at each call and never logs or stores the key.

Chat through LibraOS​

In ~/.local/share/agentd/config.toml:

[gateway]                                    # the dashboard's Chat
url = "https://api.libraos.com/v1"
key_file = "~/.config/agentd/libraos.key"

Name models in a role's model field as on the price list, such as anthropic/claude-opus-5-5 or openai/gpt-6.1-sol.

Workers through LibraOS​

[dispatch]                                   # Claude and Codex workers
claude_base_url = "https://api.libraos.com"
claude_key_file = "~/.config/agentd/libraos.key"
codex_base_url = "https://api.libraos.com/v1"
codex_key_file = "~/.config/agentd/libraos.key"
  • Claude workers send their model requests to claude_base_url, which must serve /v1/messages. With claude_key_file, the worker's settings file sets Claude Code's apiKeyHelper to agentd worker-key, which reads the key file when Claude Code needs the key. The key is sent only in request headers; it is not written to the settings file or put in the environment of the worker's commands. If the helper fails, the gateway gets an empty credential, not your own Claude login.
  • Codex workers with codex_base_url run with a model provider of AgentD's own on the Responses API; codex_key_file is required with it. The key is never on a command line, but it is in the worker's environment, so assume the worker's commands can read it.
  • Key files take an absolute path or one starting with ~/. A key file must hold the key alone on one line, belong to you and have mode 600. With [dispatch] hide set, a key file under a hidden path is refused. Key files are read each time a worker starts, so a rotated key needs no restart.
  • Transport: with a key file, the base URL must be https, or plain http only to this machine (127.0.0.0/8, ::1 or localhost).
  • Settings files: a Claude worker's settings file holds no key, has mode 600, and is removed 7 days after it was written, once the worker's result has closed.

Workers can read the key file, since they run as you: give them a key you would let them use. agentd doctor names the gateway each worker uses and fails on a key file they could not use, with the fix. That check covers dispatched workers only: agentd score and agentd bench start the client with your own login.

Costs​

A worker's result card shows its time and cost. A budget in dollars needs model prices configured in AgentD's settings; a budget in time, such as 30m, does not.

Workers dispatched from a shell get that shell's environment. An ANTHROPIC_API_KEY in your shell reaches workers you start from it, but not workers the background service starts. Use the settings above when every worker should go through LibraOS.