Kimi

Register the provider key as a named account, then grant it to each workspace that may use it. Provider credentials follow the same account allowlist as native agent profiles.

Register the key

The following command reads the key from a masked prompt and records the explicit endpoint and model:

jackin account add moonshot-work --provider moonshot --api-key \
  --base-url https://api.kimi.com/coding --model kimi-for-coding

Use --secret-ref '$KIMI_API_KEY' to reference an existing environment variable, or --secret-ref 'op://Work/Kimi/api-key' for a 1Password reference. Use the endpoint and model appropriate to your provider account.

Authorize a workspace

jackin workspace account assign my-app moonshot-work
jackin workspace account select my-app moonshot-work --agent claude

For one role, add --role agent-smith to select. The role still uses the workspace's allowlist. A key registered globally is not automatically available in every workspace.

At launch, jackin❯ resolves the selected account and configures the agent's provider endpoint and model. Host agent configuration stays separate from this account selection.

Remove workspace access

jackin workspace account unassign my-app moonshot-work

This clears workspace and role selections referring to the account. jackin account remove moonshot-work removes the account from every workspace. Neither operation revokes the provider key itself.

See Account commands and Agent authentication.