Sign in

You need a provider credential before a model can answer. Start Tatu, then type /login to choose a provider and sign-in method.

tatu

You can start the interactive interface without a credential. Tatu tells you to use /login; sending a prompt before signing in returns a sign-in error instead of calling a model.

Choose a provider

Provider	Name in commands	Sign-in method	API key environment variable
Anthropic	`anthropic`	API key or Claude Pro/Max subscription	`ANTHROPIC_API_KEY`
DeepSeek	`deepseek`	API key	`DEEPSEEK_API_KEY`
OpenAI	`openai`	API key	`OPENAI_API_KEY`
ChatGPT	`openai-codex`	ChatGPT Plus/Pro subscription	None
GitHub Copilot	`github-copilot`	GitHub Copilot subscription or a GitHub token	`COPILOT_GITHUB_TOKEN`
OpenRouter	`openrouter`	API key or OpenRouter account	`OPENROUTER_API_KEY`
xAI	`xai`	API key or SuperGrok or X Premium subscription	`XAI_API_KEY`
MiniMax	`minimax`	API key	`MINIMAX_API_KEY`
MiniMax (China)	`minimax-cn`	API key	`MINIMAX_CN_API_KEY`
Fireworks	`fireworks`	API key	`FIREWORKS_API_KEY`
Ant Ling	`ant-ling`	API key	`ANT_LING_API_KEY`
Baseten	`baseten`	API key	`BASETEN_API_KEY`
Cerebras	`cerebras`	API key	`CEREBRAS_API_KEY`
Groq	`groq`	API key	`GROQ_API_KEY`
Hugging Face	`huggingface`	API key	`HF_TOKEN`
Kimi For Coding	`kimi-coding`	API key or Kimi Code subscription	`KIMI_API_KEY`
Meta	`meta`	API key	`META_API_KEY`
Moonshot AI	`moonshotai`	API key	`MOONSHOT_API_KEY`
Moonshot AI (China)	`moonshotai-cn`	API key	`MOONSHOT_API_KEY`
NVIDIA	`nvidia`	API key	`NVIDIA_API_KEY`
OpenCode Zen	`opencode`	API key	`OPENCODE_API_KEY`
OpenCode Go	`opencode-go`	API key	`OPENCODE_API_KEY`
Qwen Token Plan	`qwen-token-plan`	API key	`QWEN_TOKEN_PLAN_API_KEY`
Qwen Token Plan (China)	`qwen-token-plan-cn`	API key	`QWEN_TOKEN_PLAN_CN_API_KEY`
Qwen Token Plan (Individual)	`qwen-token-plan-individual`	API key	`QWEN_TOKEN_PLAN_API_KEY`
Together	`together`	API key	`TOGETHER_API_KEY`
Vercel AI Gateway	`vercel-ai-gateway`	API key	`AI_GATEWAY_API_KEY`
Xiaomi	`xiaomi`	API key	`XIAOMI_API_KEY`
Xiaomi Token Plan (Amsterdam)	`xiaomi-token-plan-ams`	API key	`XIAOMI_TOKEN_PLAN_AMS_API_KEY`
Xiaomi Token Plan (China)	`xiaomi-token-plan-cn`	API key	`XIAOMI_TOKEN_PLAN_CN_API_KEY`
Xiaomi Token Plan (Singapore)	`xiaomi-token-plan-sgp`	API key	`XIAOMI_TOKEN_PLAN_SGP_API_KEY`
Z.AI	`zai`	API key	`ZAI_API_KEY`
Z.AI Coding (China)	`zai-coding-cn`	API key	`ZAI_CODING_CN_API_KEY`
LiteLLM	`litellm`	API key and the address of your proxy	`LITELLM_API_KEY` and `LITELLM_BASE_URL`

The /login, /logout and /model panels show the name in the first column, with the name used in commands (kimi-coding) dim beside it; typing either one filters the list. Commands, settings and the footer always use the second column.

OpenAI API keys and ChatGPT subscriptions are separate sign-in methods with different provider names.

Use an API key

In Tatu, run a command such as:

/login deepseek key

Paste your key into the secret input. Tatu stores it in ~/.tatu/auth.json, or in auth.json under TATU_HOME if you set that variable.

You can also export the provider’s environment variable in your shell before starting Tatu. A nonempty API key variable takes precedence over the credential stored for that provider, including a stored Anthropic subscription login.

Use a subscription

For Claude Pro/Max, run:

/login anthropic oauth

For ChatGPT Plus/Pro, run:

/login openai-codex oauth

For GitHub Copilot, run:

/login github-copilot oauth

For SuperGrok or X Premium, run:

/login xai oauth

For Kimi Code, run:

/login kimi-coding oauth

Follow the sign-in instructions to authorize in your browser. When you sign in for an agent on another computer from tatu agents, the page still opens in your browser here and the code is caught by your terminal and sent to that agent. Running /login anthropic without a method asks whether you want a subscription or an API key.

GitHub Copilot signs in with a device code instead of the browser. Tatu asks for your GitHub Enterprise domain (leave it empty for github.com), shows a code, and you enter it on the GitHub page it names, from any computer. Tatu then reads which models your account can use, turns on the ones your account has not configured yet, and lists only those in /model. The sign-in works the way Copilot Chat in VS Code does, which GitHub does not document for other programs, so it can stop working when GitHub changes it. COPILOT_GITHUB_TOKEN takes a GitHub token that has Copilot access; Tatu trades it for a short-lived Copilot token and keeps that in memory.

xAI and Kimi Code sign in with a device code too. Tatu shows a code and a page; open it from any computer, approve the code, and Tatu waits (up to the time the page names, about 10 to 15 minutes). The token is kept in auth.json and renewed when it expires. An API key from the environment or stored with /login still takes precedence over the subscription. Both sign-ins use the client of the provider’s own command-line tool, as pi does, and neither provider documents that for other programs, so they can stop working when the provider changes it. Kimi’s help center also tells third-party tools to use an API key from the Kimi Code Console, and warns that changing the client identity can suspend the benefits of a plan, so prefer the key if that worries you.

Use an OpenRouter account

Instead of pasting a key, run:

/login openrouter oauth

Tatu opens the OpenRouter page in your browser. After you approve, OpenRouter gives Tatu an API key and Tatu stores it like one you pasted, so signing out removes it and OPENROUTER_API_KEY still takes precedence. If the browser is on another computer, paste the code or the address it ended on when Tatu asks.

Use a LiteLLM proxy

LiteLLM is a proxy you or your company run, so Tatu needs two things: where it is, and a key for it. Run:

/login litellm

Tatu asks for the address (for example https://litellm.example.com; a trailing /v1 is fine), then for the key in a hidden field. It checks both against the proxy before it stores anything, so a wrong address or key is told at once. Plain http:// is accepted only for localhost, because the key would travel in the clear to any other machine.

You can set LITELLM_BASE_URL and LITELLM_API_KEY in your shell instead; each one takes precedence over what /login stored. Tatu needs both before it lists litellm as usable.

The models are the ones your proxy serves. Tatu asks the proxy for them (with your key) right after you sign in, at start, and on /model refresh, and reads their limits, prices and whether they take images or reason from what the proxy reports. The first one listed is the default for litellm; name another with /model litellm/<model>. Each model is spoken to in the protocol that suits it: Claude models go through the proxy’s Anthropic Messages endpoint, models that announce the OpenAI Responses endpoint use it, and the rest use chat completions. Tatu names the session to the proxy in the x-litellm-session-id header, so your requests are grouped in its logs.

In the /login list, a check marks the method you are signed in with. If the provider is signed in the other way, its row carries a short yellow note after the name, via api key or via subscription, instead, so you can tell which kind is in use.

Each provider has one stored credential. Signing in to Anthropic with a subscription replaces its stored API key, and signing in with a key replaces its stored subscription credential. Environment variables are not changed.

Which provider is used?

At startup, flags take precedence over the resumed session’s model, then your settings. If none picks a provider, Tatu uses the first provider with a credential in name order: ant-ling, anthropic, baseten, cerebras, deepseek, fireworks, github-copilot, groq, huggingface, kimi-coding, litellm, meta, minimax, minimax-cn, moonshotai, moonshotai-cn, nvidia, openai, openai-codex, opencode, opencode-go, openrouter, qwen-token-plan, qwen-token-plan-cn, qwen-token-plan-individual, together, vercel-ai-gateway, xai, xiaomi, xiaomi-token-plan-ams, xiaomi-token-plan-cn, xiaomi-token-plan-sgp, zai, zai-coding-cn.

If you start signed out, a successful /login switches to that provider. Signing in to another provider while you already have a working one does not switch the model. Use /model <provider> to switch; see Models and effort.

Sign out

Type /logout to choose a stored credential, or name its provider:

/logout anthropic

This removes the stored credential, not an environment variable. If that provider’s variable is still set, it remains usable. Unset it in your shell and restart Tatu to stop using it.