Configuring a Provider
List what your install knows about, then pick one:config.toml as a model slot:
api_key_env names the environment variable holding your key. Never paste the key itself — that is rejected at parse time. See Configuration.
If no slot is configured, IronClaw falls back to whichever provider environment variables are set.
Choosing Your Model
When an administrator has configured a model allowlist, every user can choose their own model under Settings → Inference. The preference applies to that user’s future messages in every conversation; it does not change the provider or another user’s preference. Administrators configure the allowlist from Settings → Inference → User model access. Add model IDs manually or fetch the active provider’s model catalog, select the models users may choose, set the workspace default, and save. Provider configuration alone does not publish models to users; this explicit step keeps newly available provider models outside the tenant allowlist until an administrator approves them. The same preference is available from chat commands:/model shows the current preference, effective model, and allowed models.
/model default returns to the workspace default. Only models from the active
provider’s administrator-approved allowlist can be selected.
Provider Overview
provider_id is the value used with models set-provider and in [llm.default].
Run
ironclaw models list for the catalog on your install, including the default model for each provider and any entries you have added yourself through providers.json.
NEAR AI
Qwen/Qwen3.5-122B-A10B, black-forest-labs/FLUX.2-klein-4B, zai-org/GLM-5-FP8
Anthropic (Claude)
claude-sonnet-4-20250514, claude-3-5-sonnet-20241022, claude-3-5-haiku-20241022
OpenAI (GPT)
gpt-4o, gpt-4o-mini, o3-mini
Google Gemini (OAuth)
Uses Google OAuth with PKCE (S256) for authentication — no API key required. On first run, a browser opens for Google account login. Credentials (including refresh token) are saved to~/.gemini/oauth_creds.json with 0600 permissions.
Supported features
Popular models
Cloud Code API vs standard API
Models containing-preview (with hyphen) or gemini-3 in the name, as well
as any gemini- model with major version >= 2, route through the Cloud Code
API (cloudcode-pa.googleapis.com) which supports SSE streaming
and project-scoped access. Other models use the standard Generative Language
API (generativelanguage.googleapis.com).
GitHub Copilot
GitHub Copilot exposes chat endpoint athttps://api.githubcopilot.com. IronClaw uses that endpoint directly through the
built-in github_copilot provider.
ironclaw onboard can acquire this token for you using GitHub device login. If you
already signed into Copilot through VS Code or a JetBrains IDE, you can also reuse
the oauth_token stored in ~/.config/github-copilot/apps.json. If you prefer,
LLM_BACKEND=github-copilot also works as an alias.
Popular models vary by subscription, but gpt-4o is a safe default. IronClaw keeps
model entry manual for this provider because GitHub Copilot model listing may require
extra integration headers on some clients. IronClaw automatically injects the standard
VS Code identity headers (User-Agent, Editor-Version, Editor-Plugin-Version,
Copilot-Integration-Id) and lets you override them with
GITHUB_COPILOT_EXTRA_HEADERS.
Ollama (local)
Install Ollama from ollama.com, pull a model, then:ollama pull llama3.2
MiniMax
MiniMax provides high-performance language models with 204,800 token context windows.MiniMax-M2.7 (default), MiniMax-M2.7-highspeed, MiniMax-M2.5, MiniMax-M2.5-highspeed
To use the China mainland endpoint, set:
AWS Bedrock (requires --features bedrock)
Uses the native AWS Converse API via aws-sdk-bedrockruntime. Supports standard AWS
authentication methods: IAM credentials, SSO profiles, and instance roles.
Build prerequisite: Theaws-lc-syscrate (transitive dependency via AWS SDK) requires CMake to compile. Install it before building with--features bedrock:
- macOS:
brew install cmake- Ubuntu/Debian:
sudo apt install cmake- Fedora:
sudo dnf install cmake
With AWS credentials (IAM, SSO, instance roles)
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), shared credentials file
(~/.aws/credentials), SSO profiles, and EC2/ECS instance roles.
Cross-region inference
SetBEDROCK_CROSS_REGION to route requests across AWS regions for capacity:
Popular Bedrock model IDs
OpenAI-Compatible Endpoints
OpenRouter, Together AI, Fireworks and the rest now have their ownprovider_id entries — use those directly rather than the generic adapter.
Reach for openai_compatible when your endpoint has no dedicated entry: vLLM, LiteLLM, LM Studio, or an internal gateway. It needs a base_url, because the generic adapter has no default host of its own:
base_url leaves the slot pointing nowhere and model resolution fails. base_url also works on any other provider when you need to route it through a proxy or a regional endpoint.
The sections below list model ids for popular hosts. Each is reachable through its own provider_id; set model to the id you want.
Several examples on this page use the LLM_BACKEND / LLM_MODEL / LLM_BASE_URL / LLM_API_KEY environment variables instead of a TOML slot. Both work: the environment form is the fallback IronClaw uses when [llm.default] is not configured. Prefer the TOML slot for a permanent install, and the environment form for one-off runs and containers.
OpenRouter
OpenRouter routes to 300+ models from a single API key.
Browse all models at openrouter.ai/models.