Choose an AI provider

open·kritt needs one AI access method. You can configure more than one and choose between them per run, but a single working provider is enough to start.

Provider	Access method	Model input
Codex	ChatGPT/Codex login or an OpenAI Platform key	Account-specific picker
Claude	Claude subscription login or ANTHROPIC_API_KEY	Subscription aliases or account-specific picker
OpenRouter	OPENROUTER_API_KEY	Exact model ID as free text

◆Codex

Use the recommended ChatGPT device login or an OpenAI Platform API key.

◆Claude Code

Sign in with an eligible Claude subscription, or use an Anthropic API key.

◆OpenRouter

Use one key to access compatible models through OpenRouter.

Common setup flow

1. Open setup

   From the repository root, run:

   ./kritt setup

2. Choose one access method

   Select Codex login, OpenAI API key, Codex API key, Anthropic API key, or OpenRouter API key. Follow the provider guide above to obtain the correct credential. The CLI configures keys and Codex login; Claude subscription login is available from the running application's Accounts page.

3. Start or recreate the stack

   ./kritt start

   If open·kritt is already running, stop the attached stack with Ctrl+C first. Existing containers do not receive a newly changed .env value until Compose recreates them.

4. Verify the provider

   Run ./kritt setup again and confirm the selected method is marked as present. The workflow generator, post-script generator, and new-scan form will list only providers that open·kritt detects as configured.

Credential handling

API keys configured by the CLI are written to the repository's .env file. Codex logins are stored under ENGINE_CODEX_ACCOUNTS_HOST, which defaults to ./.data/codex-accounts; a Claude login is stored under ENGINE_CLAUDE_HOME, which defaults to ./.data/claude. The Accounts page keeps Codex account paths and its OpenRouter key synchronized with .env, and mirrors the OpenRouter key under .data/engine/credentials so running services see changes immediately. .env and .data/ are ignored by Git.

Warning

Treat .env, ./.data/codex, ./.data/codex-accounts, ./.data/claude, and the engine credential store as secrets. Never commit them, paste them into an issue, or share them with another user. Revoke and replace a credential immediately if it is exposed.

The backend has private write access to .env and the provider stores so Accounts can persist additions and removals, but secret values are never returned by the API. The engine receives the actual credential when it starts a model harness.

Note

GITHUB_TOKEN is not an AI provider credential. It is optional and is only needed to clone private GitHub repositories or dependencies.

Next: configure the recommended Codex provider, Claude Code, or OpenRouter.