LLM Setup

drep supports OpenAI-compatible and Anthropic-compatible HTTP endpoints plus a separate Codex CLI backend. The interactive wizard is the safest starting point.

drep init

The wizard asks for a provider and credential, then requests that endpoint's model list when supported. Listing failures never prevent setup; you can enter a model name directly.

Provider presets

HTTP providers

For a preset, let the wizard store the key in drep's private machine-level store:

drep init --provider openrouter
drep auth login --provider openrouter

For CI, reference an environment variable in drep.toml. An explicit variable is authoritative and overrides a stored key.

[[llm]]
endpoint = "https://openrouter.ai/api/v1"
model = "deepseek/deepseek-v4-pro-0813"
api_key = "${OPENROUTER_API_KEY}"

Short-lived credentials

For a gateway whose tokens expire in minutes, api_key_command runs an argv directly and uses its trimmed stdout as the credential. It does not invoke a shell and never writes the result to disk.

[[llm]]
endpoint = "https://gateway.example/v1"
model = "m"
api_key_command = ["gcloud", "auth", "print-access-token"]

The resolution order is an explicit api_key, then api_key_command, then the endpoint-keyed store. Configure only one of api_key and api_key_command; the Codex backend rejects this HTTP-only field.

The helper runs once per process for each enabled provider that declares it. A non-zero exit, empty output, or output larger than 64 KiB exits 2 without falling through to another provider, and diagnostics do not echo helper output. drep doctor invokes the helper to test the real path unless site policy has already refused review or could not be evaluated.

Custom request headers

Gateways can require a tenant, billing, routing, user-agent, or nonstandard authentication header. Add a table to that provider; a configured name replaces the protocol or drep default:

[[llm]]
endpoint = "https://gateway.example/v1"
model = "m"

[llm.headers]
"Authorization" = "Bearer ${GATEWAY_TOKEN}"
"X-Tenant-ID" = "${TENANT_ID}"

Values support environment expansion and may be credentials. drep never prints them; drep doctor lists only the effective names and marks User-Agent (default) when drep supplied drep/<version>. When no protocol key resolves, no fabricated Authorization or x-api-key is sent.

HTTP endpoints are exact origins. drep refuses redirects for completions and authenticated model listing, including redirects on the same origin, so configured credentials cannot be replayed to a response-selected destination. Invalid header encodings and duplicate case-insensitive names are rejected when the config loads. The effective header set and max_tokens are part of response-cache identity.

ChatGPT subscription through Codex

The codex preset is intentionally separate from the openai preset. OpenAI API access uses an API key and API billing; Codex uses a separately installed CLI authenticated through ChatGPT.

codex login
drep init --provider codex
drep doctor

drep never reads or stores the subscription tokens. Codex owns login and token refresh. Each review is non-interactive, ephemeral, read-only, and isolated from normal project instructions, tools, apps, MCP servers, hooks, memories, and user configuration.

Wire protocols

protocol = "openai" is the default. Select anthropic only when that specific endpoint exposes Anthropic messages:

[[llm]]
endpoint = "https://api.minimax.io/anthropic/v1"
model = "MiniMax-M3"
protocol = "anthropic"

Model-aware controls

The wizard uses cached model metadata to omit unsupported temperature values and apply an output ceiling only when an endpoint requires one. Nothing about model listing or metadata can stop initialization; drep falls back to provider defaults when necessary.

Verify the active chain

drep doctor
drep check --staged