---
title: "oz0 provider pool add"
description: "Usage and flags for oz0 provider pool add."
canonical_url: "https://docs.oz0.ai/reference/cli/oz0/provider/pool/add"
---
# oz0 provider pool add

> Usage and flags for oz0 provider pool add.

For: Operators and developers looking up a command.

Add a deployment to a provider record's pool, or change the member of that ID: its own --base-url, and what it does not share with the record (its key secret, region, whether it keeps data, its auth).

--rpm, --input-tpm and --output-tpm declare its limits per minute where its provider's headers do not say them; --price sets its own price for a model, in dollars per million input, output, cache-read and cache-write tokens, where its region is priced differently: a price left out keeps the record's, and without a price on the record give the cache prices too.

A record that calls its own base_url keeps calling it as a member (--record-member, primary by default); --preset starts a new pooled record from a shipped preset. Pool only what your contracts with the provider allow.

## Usage

```bash
oz0 provider pool add <provider> <member> [flags]
```

## Flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --access-key-secret
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the tenant secret with SigV4's access key ID; --key-secret holds the secret access key
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --audience
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the JWT bearer assertion's audience (the token URL when empty)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --auth-header
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the header its key goes in, when it differs from the record's
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --auth-kind
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      how calls are signed: header (a key in --auth-header, the default), oauth2_client_credentials, oauth2_jwt_bearer, sigv4 or federated (no stored key)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --auth-prefix
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      what comes before its key in that header, such as "Bearer "
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --aws-region
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the region SigV4 signs for, such as eu-north-1
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --aws-role
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --cloud aws: the IAM role's ARN the calling agent assumes (with --aws-region and --aws-service)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --aws-service
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the service SigV4 signs for, such as bedrock
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --base-url
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the member's own endpoint, which a call's path is appended to: https, or http to this machine or on a record cluster admins own
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --client-auth
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      how the client secret is sent to the token URL: post (the default) or basic
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --client-id
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the OAuth2 client (client credentials), or a bare PEM key's issuer (JWT bearer)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --cloud
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --auth-kind federated: aws, gcp or entra, the cloud that trusts the tenant's issuer
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --entra-directory
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --cloud entra: the directory (tenant ID or domain) of the app registration (--client-id)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --gcp-service-account
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --cloud gcp: a service account the federated token impersonates
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --gcp-workload-provider
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      with --cloud gcp: the workload identity pool provider, //iam.googleapis.com/projects/&lt;number>/locations/global/workloadIdentityPools/&lt;pool>/providers/&lt;provider>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --input-tpm
      </code>
    </td>
    
    <td>
      int
    </td>
    
    <td>
      
    </td>
    
    <td>
      its input tokens per minute, where its provider's headers do not say
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --key-secret
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the tenant secret with the member's key; empty takes the record's
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --output-tpm
      </code>
    </td>
    
    <td>
      int
    </td>
    
    <td>
      
    </td>
    
    <td>
      its output tokens per minute, where its provider's headers do not say
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --preset
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      start a new pooled record from a shipped preset, such as azure-openai or bedrock
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --price
      </code>
    </td>
    
    <td>
      stringArray
    </td>
    
    <td>
      
    </td>
    
    <td>
      its own price for a model as &lt;model>=&lt;input>,&lt;output>[,&lt;cache read>[,&lt;cache write>]] in $/MTok, such as claude-sonnet-5=3.3,16.5,0.33,4.125; repeatable
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --record-member
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        primary
      </code>
    </td>
    
    <td>
      for a record that calls its own base_url: the member that endpoint becomes
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --region
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      where the member processes data, such as eu-north; empty takes the record's
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --retains-data
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      the member keeps prompts or answers after a call; unset takes the record's
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --rpm
      </code>
    </td>
    
    <td>
      int
    </td>
    
    <td>
      
    </td>
    
    <td>
      its requests per minute, where its provider's headers do not say
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --scope
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      what an OAuth2 token is for, such as <code>
        https://ai.azure.com/.default
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --session-token-secret
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      the tenant secret with a SigV4 session token, for temporary credentials
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --shared
      </code>
    </td>
    
    <td>
      bool
    </td>
    
    <td>
      
    </td>
    
    <td>
      the record every tenant sees (cluster admins)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --tenant
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        default
      </code>
    </td>
    
    <td>
      tenant whose own record it is
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --token-url
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      
    </td>
    
    <td>
      where the OAuth2 kinds get tokens; the edge calls it (an outbound connection)
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --weight
      </code>
    </td>
    
    <td>
      float
    </td>
    
    <td>
      
    </td>
    
    <td>
      its share among members with the same headroom (1 when not given)
    </td>
  </tr>
</tbody>
</table>

## Inherited flags

<table>
<thead>
  <tr>
    <th>
      Flag
    </th>
    
    <th>
      Type
    </th>
    
    <th>
      Default
    </th>
    
    <th>
      Description
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <code>
        --context
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        $OZ0_CONTEXT or &lt;config dir>/orchestrator-zero/context.json
      </code>
    </td>
    
    <td>
      CLI context file written by server init
    </td>
  </tr>
  
  <tr>
    <td>
      <code>
        --log-level
      </code>
    </td>
    
    <td>
      string
    </td>
    
    <td>
      <code>
        info
      </code>
    </td>
    
    <td>
      log level: debug, info, warn or error
    </td>
  </tr>
</tbody>
</table>

See [all `oz0` commands](https://docs.oz0.ai/reference/cli/oz0) and the [global flags](https://docs.oz0.ai/reference/cli/oz0#global-flags).


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.