API Providers
Every provider Stella speaks to — the full matrix, the auto-detection order, and the credential chain. Bring your own key; Stella talks each provider's native dialect.
Stella is BYOK — bring your own key — and vendor-agnostic by construction. There is no
proxy in the middle and no markup on your tokens: Stella speaks each provider's native wire
dialect directly — Anthropic Messages, OpenAI Responses, Gemini generateContent, Bedrock
Converse, and the OpenAI-compatible dialect the rest of the field converged on. Switching
vendors is a --model flag, not a migration.
The provider matrix
| Provider | id | Primary env var | Default model | Dialect |
|---|---|---|---|---|
| Anthropic | anthropic | ANTHROPIC_API_KEY | claude-fable-5 | Anthropic Messages |
| OpenAI | openai | OPENAI_API_KEY | gpt-5.5 | OpenAI Responses |
| Google Gemini | gemini | GEMINI_API_KEY (alias GOOGLE_API_KEY) | gemini-3-pro | Gemini generateContent |
| Google Vertex AI | vertex | VERTEX_ACCESS_TOKEN | gemini-3-pro | Gemini via Vertex |
| Amazon Bedrock | bedrock | AWS_ACCESS_KEY_ID | us.anthropic.claude-sonnet-4-5-20250929-v1:0 | Bedrock Converse |
| xAI | xai | XAI_API_KEY | grok-4 | OpenAI-compatible |
| DeepSeek | deepseek | DEEPSEEK_API_KEY | deepseek-chat | OpenAI-compatible |
| Z.ai | zai | ZAI_API_KEY | glm-5.2 | OpenAI-compatible |
| OpenRouter | openrouter | OPENROUTER_API_KEY | openrouter/auto | OpenAI-compatible |
| Local | local | none (optional LOCAL_API_KEY) | you choose | OpenAI-compatible |
Each provider name links to its dedicated page — setup, model selection, provider-specific configuration, and catalog pricing. For a quick first-run walkthrough, see Providers & models.
Auto-detection
With no --model flag and no configured default, Stella selects the first provider that
has a resolvable credential, in this preference order:
zaianthropicopenaixaideepseekgeminiopenroutervertexandbedrock— last, deliberately
Vertex and Bedrock sit last on purpose: they key off generic cloud credentials
(VERTEX_ACCESS_TOKEN, AWS_ACCESS_KEY_ID) that are often present in a shell for
entirely unrelated reasons. Generic cloud credentials must not hijack detection — pin
these providers explicitly with --model vertex/… or --model bedrock/… when you want
them. The local pseudo-provider is never auto-detected at all.
The "configured default" above is a real resolution layer with a name:
agent_engine_config's default_model. It
sits between the --model flag and auto-detection — an explicit flag always wins,
but a settings-configured default beats "first provider with a key":
{
"agent_engine_config": {
"default_model": "anthropic/claude-fable-5"
}
}The credential chain
For the selected provider, Stella resolves the API key in this order — first hit wins:
- The
--api-keyflag (requires an explicit--model provider/...) - The provider's env var, plus aliases — e.g.
GOOGLE_API_KEYfor Gemini settings.jsonproviders.<id>.api_key~/.config/stella/credentials.toml- An interactive prompt (on a TTY) — the entered key is saved to
credentials.toml, so you are only prompted once
See Credentials for the file format and the fine print.
Prefer an env var, settings.json, or credentials.toml over --api-key for anything
long-lived — a flag value is visible in shell history and in ps output.
Overriding the key source
Two settings.json fields reroute steps 2 and 3 of the chain — every provider page's
"reference an env var" option is this mechanism, documented once here:
providers.<id>.api_key_envrenames the provider's primary credential var: the named var becomes the one Stella checks first, and the original (ANTHROPIC_API_KEY,OPENAI_API_KEY, …) demotes to an alias — so the standard var keeps working as a fallback.providers.<id>.api_keyembeds the key literal inline — step 3 of the chain. Fine for a scratch machine;credentials.tomlis the better home for anything long-lived.
{
"providers": {
"anthropic": {
"api_key_env": "MY_TEAM_ANTHROPIC_KEY"
}
}
}Scope matters. In a project's .stella/settings.json, the credential-routing fields —
base_url, api_key, api_key_env — are ignored (with a stderr notice) unless
you export STELLA_TRUST_PROJECT=1: a cloned repo must not be able to redirect where
your key is sent. User scope (~/.config/stella/settings.json) always applies — put
personal overrides there. See
the project trust boundary.
Where to go next
- Choosing a model — the Model guide is the master catalog: context windows, list prices, and which model fits which role.
- Tuning profiles — Examples has ready-made lineups from max-quality to dirt-cheap.
- Per-agent routing — Agent engine config gives each engine agent (worker, judge, triage) its own model, provider, and effort — including a different gateway per agent.
Repo initialization
Prime a workspace with stella init — the domain taxonomy, the tree-sitter code graph, extension adoption, and everything that lands under .stella/.
Model guide
The master model catalog — context windows, list prices per million tokens, release timing, and which model to use for which role in the pipeline.