---
title: "Connect a model"
description: "Add a provider with /connect, import keys from a file, and pick a model with /model."
url: https://barestate.xyz/docs/guides/connect-a-model
---

# Connect a model

> Add a provider with /connect, import keys from a file, and pick a model with /model.

Oh My Sol (OMS) doesn't supply a model. You bring the access you already have, either an API key or a subscription, and connect it inside OMS. The OMS account does not select a model or carry model traffic, so connecting a provider is a separate step you do once.

## Connect with a key or a subscription

```text
/connect
/model
```

For each provider, `/connect` offers an API key entry and, where the provider supports it, a subscription (OAuth) sign-in. Once a provider is connected, `/model` lets you choose a model, and `/model search` filters the list.

| Way to connect | Provider id or note |
|---|---|
| Codex or ChatGPT subscription | `openai-codex` |
| MiMo Token Plan | Needs an explicit region |
| OpenCode Go | Subscription sign-in |
| OpenAI API key | |
| Anthropic API key | |

**Warning:**
Claude subscription login is refused. OMS prints: "Anthropic does not permit third-party Claude subscription login. Use an Anthropic API key." To use Claude models, connect an Anthropic API key.

Custom endpoints and a `models.json` file are disabled.

## What OMS accepts as a key

OMS rejects keys that are empty, contain whitespace or control characters, contain `$`, or start with `!`. The reason is that a saved key should never be able to act as a command or a variable reference.

Saving a key sends no validation request, so only a successful model response proves the connection works. If a request fails right after you save a key, check the key first.

## Import keys from a file

If your keys already live in a file, you can import them in one step.

```text
/connect import <path>
```

The file must be a regular file that you own, with mode `0600`, one link, and at most 64 KiB. OMS opens it without following links, and each name must appear once with a literal value. These are the names it accepts:

| Accepted names |
|---|
| `OPENAI_API_KEY` |
| `ANTHROPIC_API_KEY` |
| `OPENCODE_API_KEY` |
| `XIAOMI_API_KEY` |
| `XIAOMI_MIMO_TP_API_KEY` |

OMS shows you the names it found, not the values, and asks you to confirm. It refuses values that contain `$`, backticks or control characters, or that start with `!`, and a bad file writes nothing.

For the MiMo Token Plan, the import needs an explicit region and has no pay-as-you-go fallback. If the file holds both kinds of MiMo key, you choose which one routes requests.

## Where credentials are stored

Provider credentials go in `auth.json` inside the `agent` folder of the OMS state root. The folder and files must be private: owned by you, with no group or other access, and not a symlink. OMS refuses a file that is too open and does not repair it. See [Credentials](https://barestate.xyz/docs/security/credentials).

## If it fails

If a key is rejected at save time, remove any whitespace, `$`, or leading `!`. Setup errors are generic on purpose, so a stored credential is never echoed back to you. If you get a permission error on a credentials file, set the file to owner-only access and try again.