pinecall providers · Pinecall Docs

pinecall providers [--does llm|stt|tts]   # every vendor this build runs
pinecall providers add <vendor>     # the key on stdin, never on the command line
pinecall providers rm <vendor>
pinecall providers list             # only the ones this org brought

Terminal

$ pinecall providers --does tts
vendor        does         standing   variable              also known as
livekit       llm,stt,tts  ready                            inference lk
cartesia      stt,tts      no key     CARTESIA_API_KEY
elevenlabs    stt,tts      ready      ELEVEN_API_KEY        11labs eleven elevenlab
rime          tts          no key     RIME_API_KEY
speechmatics  stt,tts      no plugin  SPEECHMATICS_API_KEY

With nothing after it: every vendor this build runs — forty-five, every one LiveKit ships a plugin for, plus livekit itself, which is LiveKit Inference and fronts most of them on the platform's own project with no vendor key at all. standing is the one word for what each is still waiting for: ready is the only one that runs a call, no plugin and no key are the operator's to fix, and its own is a vendor whose credentials are a chain or a pair and never one key anybody could bring. Any of these names — or any of its aliases — is what agent set --stt, --llm and --tts take: the six knobs are the agent's settings, and pipeline only reads them back.

A key added here is this org's own account with that vendor, and every call of this org runs on it from the next one; every vendor nobody brought runs on the platform's own key. add reads the key from stdin — typed with nothing echoed on a terminal, one piped line off one — and never from a flag: argv is visible in ps to every user on the platform, and a key pasted as an argument is a key in the shell history.

No endpoint a person reads ever answers with a provider key: list prints the vendors and nothing else, not a value, not a prefix, not a fingerprint. The one endpoint that reads a key back is the worker's — GET /v1/agents/{slug}/provider-keys, an org's own keys handed to the org's own process, on that org's key — which is the whole reason the vault exists. A key that was lost is set again. A runtime with no PINECALL_VAULT_KEY cannot keep somebody else's secret and says so with a 503; the vault, and how to turn it on, is the gateway API's §6.