> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# nora providers

> Manage LLM provider API keys — set, delete, check readiness per Flow.

Nora runs your Agents against models from multiple providers (OpenAI, Anthropic, Google, and more). Each provider needs a per-workspace API key. `providers` is the CLI for managing them.

## Commands

| Command                       | Description                                              |
| ----------------------------- | -------------------------------------------------------- |
| `providers list`              | Print every provider and whether it has a key.           |
| `providers set <provider>`    | Store an API key for a provider.                         |
| `providers delete <provider>` | Remove the stored key.                                   |
| `providers check <flow-slug>` | Report which providers a Flow needs vs. which have keys. |

## `providers list`

```bash theme={null}
nora providers list
```

Prints all supported providers and their status:

* `openai`: **configured** — key set.
* `anthropic`: **not configured** — no key.
* `google`: **configured**.

Add `--json` for structured output.

## `providers set`

```bash theme={null}
# Interactive (masked)
nora providers set openai --stdin <<< "sk-..."

# From environment variable (recommended)
nora providers set openai --env OPENAI_API_KEY

# Literal (with shell-history warning)
nora providers set openai sk-...
```

Flags:

* `<provider>` (positional, required) — provider ID.
* `--stdin` — read key from stdin. Preferred.
* `--env <var>` — read from environment variable. Preferred for CI.
* Positional key — literal. Least preferred (lands in shell history).

Stored keys are encrypted at rest and never returned via any API — the CLI can never read them back.

Rotate by re-running `set` with a new key. Old key is replaced immediately.

## `providers delete`

```bash theme={null}
nora providers delete openai
```

Removes the stored key. Any Flow using this provider's models will fail until you set a new key.

Confirmation required unless `--yes` passed.

## `providers check`

```bash theme={null}
nora providers check support-agent
```

For a specific Flow, reports:

* Which providers the Flow's Agent blocks reference.
* Which of those providers have keys configured.
* Any gaps.

Great as a pre-publish check — catches "we changed models but forgot to add the key" before ship.

Example output:

```
Flow: support-agent
  openai:    ✓ configured  (used by 3 Agents)
  anthropic: ✗ MISSING     (used by 1 Agent — ag_secondary)
  google:    - not used
```

Add `--json` for scriptable output — CI can gate on it.

## Recipes

### Set keys from environment in a bootstrap script

```bash theme={null}
nora providers set openai --env OPENAI_API_KEY
nora providers set anthropic --env ANTHROPIC_API_KEY
nora providers set google --env GOOGLE_API_KEY
```

Fits well in a workspace setup runbook.

### CI: fail if any provider is missing for a Flow

```bash theme={null}
if nora providers check support-agent --json | jq -e '.gaps | length > 0' > /dev/null; then
  echo "Missing provider keys — set them before publishing."
  exit 1
fi
```

### Rotate a key with grace

```bash theme={null}
# Set the new key (overwrites)
nora providers set openai --env OPENAI_API_KEY_NEW
```

Rotation is atomic — new key is used from the next call. Existing in-flight runs finish on the old key.

Watch traces for auth failures over the next few minutes as a sanity check:

```bash theme={null}
sleep 300
nora traces list --status error --search "OpenAI" --limit 10
```

### Migrate keys between workspaces

```bash theme={null}
# Export from source (via a secure vault, not the CLI — CLI can't read back)
# Then set in destination:
nora --workspace destination providers set openai --stdin < ~/.secrets/openai
```

Keys are workspace-scoped — each workspace has its own.

## Providers and cost

Provider keys are billed by the provider directly (OpenAI, Anthropic, ...) unless you're on a Nora-managed model tier. The Nora platform's own billing is separate — see [`nora billing`](/cli/billing).

Use per-workspace keys for cost attribution: your OpenAI dashboard shows spend by API key, so a per-workspace key lets you split cost per team or per environment.

## Related

* [`nora agents update --set-model`](/cli/agents) — pick a model on an Agent.
* [`nora billing`](/cli/billing) — Nora platform billing (not provider billing).
* [Approve & deploy](/reliable/optimization/approve) — approvals gate model swaps if configured.