oz0 provider set
Add or change a provider record.
For: Operators and developers looking up a command.
Add or change a provider record. An existing record the tenant sees is the starting point, or --preset names a shipped one (see provider list --presets); flags change single fields. Without --shared the record is the tenant's own, and replaces a shared record of the same ID for that tenant only; --shared changes the record every tenant sees, which only cluster admins may. The key itself is a tenant secret: set it with oz0 secret set <NAME>.
Usage
oz0 provider set <id> [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--access-key-secret | string | the tenant secret with SigV4's access key ID; --key-secret holds the secret access key | |
--audience | string | the JWT bearer assertion's audience (the token URL when empty) | |
--auth-header | string | the header its key goes in, such as Authorization or X-Api-Key | |
--auth-kind | string | how calls are signed: header (a key in --auth-header, the default), oauth2_client_credentials, oauth2_jwt_bearer, sigv4 or federated (no stored key) | |
--auth-prefix | string | what comes before the key in that header, such as "Bearer " | |
--aws-region | string | the region SigV4 signs for, such as eu-north-1 | |
--aws-role | string | with --cloud aws: the IAM role's ARN the calling agent assumes (with --aws-region and --aws-service) | |
--aws-service | string | the service SigV4 signs for, such as bedrock | |
--base-url | string | what a call's path, such as v1/chat/completions, is appended to | |
--cache | string | its prompt cache's facts as JSON, such as '{"style":"none"}' or '{"short_seconds":300,"min_tokens":2048}'; empty takes its format's defaults | |
--charges | string | what it charges besides tokens, as JSON, such as '{"tools":{"web_search":{"usd":0.02}},"tiers":{"service_tier":{"priority":1.8}}}'; each fact replaces the shipped one of that name; empty takes the shipped ones | |
--client-auth | string | how the client secret is sent to the token URL: post (the default) or basic | |
--client-id | string | the OAuth2 client (client credentials), or a bare PEM key's issuer (JWT bearer) | |
--cloud | string | with --auth-kind federated: aws, gcp or entra, the cloud that trusts the tenant's issuer | |
--description | string | what it is, for people | |
--disabled | bool | keep the record, but route nothing to it | |
--entra-directory | string | with --cloud entra: the directory (tenant ID or domain) of the app registration (--client-id) | |
--format | strings | wire formats it speaks, its default first: anthropic-messages, openai-chat, openai-responses, google-generate-content | |
--gcp-service-account | string | with --cloud gcp: a service account the federated token impersonates | |
--gcp-workload-provider | string | with --cloud gcp: the workload identity pool provider, //iam.googleapis.com/projects/<number>/locations/global/workloadIdentityPools/<pool>/providers/<provider> | |
--internal | bool | a tenant's record may reach private addresses, such as a server next to the edge (cluster admins) | |
--key-secret | string | the tenant secret that holds its key, bound to the provider's host or token URL's host unless it is a built-in provider's key (oz0 secret set NAME --host HOST) | |
--model-in | string | where calls name the model: body or path | |
--preset | string | start from a shipped preset, such as openrouter or mistral | |
--price-provider | string | its ID in genai-prices, when that differs | |
--price-source | string | genai-prices, reported (its own usage.cost) or none | |
--provider-state | string | own says this provider account, and each pool member's, serves this tenant alone, so calls may name what it stores: prior responses, files, caches (cluster admins, a tenant's own record; empty takes it back) | |
--region | string | where it processes data, such as eu, eu-north or us | |
--retains-data | bool | it keeps prompts or answers after a call; required for a new record without --preset | |
--scope | string | what an OAuth2 token is for, such as https://ai.azure.com/.default | |
--session-token-secret | string | the tenant secret with a SigV4 session token, for temporary credentials | |
--shared | bool | the record every tenant sees (cluster admins) | |
--tenant | string | default | tenant whose own record it is |
--token-url | string | where the OAuth2 kinds get tokens; the edge calls it (an outbound connection) | |
--translator | string | the record is a translation gateway you run as a process of its own, which makes its calls lossy: agentgateway or agent-router (empty for none) |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.