Providers & sign-in · Daemon API

On this page

App providers and which agents use them

GET/runtime/providers

Operation getRuntimeProvidersAuthBearer token

Responses

Status Description Body

200 Providers (hasApiKey only) ProviderDiagnostics

providersrequired array<ProviderDiagnosticsEntry>

11 fields of providers

idrequired string

typerequired string

namerequired string

baseUrlrequired string

defaultModel string

preset string

credentialStoragerequired

string

app or agent

apiKeyStorage string

hasApiKeyrequired boolean

requestDelayMsrequired integer

paramsrequired array<object>

2 fields of params

`key`required	string
`hasValue`required	boolean

agentUsagerequired array<object>

7 fields of agentUsage

`agentId`required	string
`handle`	string
`name`required	string
`providerId`required	string
`modelId`required	string
`source`required	string	One of `agent`, `app`, `missing`
`credentialStorage`required	string \| null

Errors 401 · 403

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl "http://127.0.0.1:7385/runtime/providers" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

Add an API-key provider

POST/runtime/providers

Operation addRuntimeProviderAuthBearer token

For every agent on this daemon. The key goes to the daemon secret store (OS keychain, or the owner's passphrase file), never the settings file, and is never returned: the settings entry carries apiKeyStorage: "secret-store" and an empty apiKey, and the daemon fills the key in when it resolves the provider. openai-compatible needs baseUrl (apiKey optional, for local servers); subscriptions (ChatGPT, Grok) sign in instead (400 subscription_type). The name is made unique (OpenRouter 2); the first provider becomes the default.

Request bodyapplication/json · AddProviderBody · required

Field	Type	Description
`type`required	string	One of `anthropic`, `openai`, `openrouter`, `openai-compatible`
`name`	string
`baseUrl`	string	Required for openai-compatible
`defaultModel`	string
`preset`	string	Provider catalog key (e.g. groq)
`apiKey`	string	Required except for openai-compatible. Stored in the daemon secret store, never returned.

Responses

Status Description Body

201 Added AddProviderResponse

providerrequired

object

An app-level provider as clients see it: never the key.

9 fields of provider · PublicProvider

`id`required	string
`type`required	string
`name`required	string
`baseUrl`required	string
`defaultModel`	string
`preset`	string
`credentialStorage`required	string	`app` or `agent`
`apiKeyStorage`	string
`hasApiKey`required	boolean

defaultProviderIdrequired string | null

Errors 400 · 401 · 403 · 405 · 409 · 500

400	Invalid body (`bad_type`, `subscription_type`, `api_key_required`, `base_url_required`, `bad_base_url`)
401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`
405	Settings store is read-only (`read_only`)
409	The secret store is locked or not set up (`secret_store_locked`): set up or unlock the owner identity first
500	Saving failed (`save_failed`)

Error bodies use the error format.

Example

Request

curl -X POST "http://127.0.0.1:7385/runtime/providers" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type":"anthropic","apiKey":"sk-ant-…"}'

Remove an app provider and its stored key

DELETE/runtime/providers/{id}

Operation removeRuntimeProviderAuthBearer token

The default moves to the next provider.

Path parameters

Name	Type	Description
`id`required	string	App provider id (settings.providers[].id) example: custom:ab12cd

Responses

Status Description Body

200 Removed RemoveProviderResponse

removedrequired string

providersrequired array<PublicProvider>

9 fields of providers

`id`required	string
`type`required	string
`name`required	string
`baseUrl`required	string
`defaultModel`	string
`preset`	string
`credentialStorage`required	string	`app` or `agent`
`apiKeyStorage`	string
`hasApiKey`required	boolean

Errors 401 · 403 · 404 · 405

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`
404	Unknown provider (`not_found`)
405	Settings store is read-only (`read_only`)

Error bodies use the error format.

Example

Request

curl -X DELETE "http://127.0.0.1:7385/runtime/providers/custom%3Aab12cd" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

List a provider's models

GET/runtime/models

Operation listRuntimeProviderModelsAuthBearer token

App providers, or an agent's own provider (and its agent-scoped key) with agentId. Remote failures come back as 200 { models: [], error }.

Query parameters

Name	Type	Description
`provider`required	string	Provider id example: anthropic
`agentId`	string	Resolve the provider in this agent's config

Responses

Status Description Body

200 Models ModelsResponse

`provider`required	string
`models`required	array<string>
`error`	string	Listing failed (the call itself still answers 200)

Errors 400 · 401 · 403

400	Invalid request: missing or malformed field, query parameter or body. A body Fastify cannot parse gets Fastify's own shape (`statusCode`, `code`, `error`, `message`).`bad_requestFST_ERR_CTP_EMPTY_JSON_BODY`
401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl "http://127.0.0.1:7385/runtime/models?provider=anthropic" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

Response 200

{
  "provider": "anthropic",
  "models": [
    "claude-sonnet-4-5",
    "claude-opus-4-1"
  ]
}

Sign-in and API-key status of every provider

GET/runtime/auth

Operation getRuntimeAuthAuthBearer token

Responses

Status Description Body

200 Auth status AuthDiagnostics

chatgptrequired object

5 fields of chatgpt · SubscriptionAuthStatus

`authenticated`required	boolean
`email`	string
`expiresAt`	integer	Epoch ms
`flowPending`	boolean
`flowError`	string

grokrequired object

5 fields of grok · SubscriptionAuthStatus

`authenticated`required	boolean
`email`	string
`expiresAt`	integer	Epoch ms
`flowPending`	boolean
`flowError`	string

providersrequired array<object>

5 fields of providers

`id`required	string
`type`required	string
`name`required	string
`credentialStorage`required	string
`hasApiKey`required	boolean

Errors 401 · 403

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl "http://127.0.0.1:7385/runtime/auth" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

ChatGPT subscription sign-in status

GET/auth/chatgpt/status

Operation getChatGptAuthStatusAuthBearer token

Responses

Status Description Body

200 Status SubscriptionAuthStatus

`authenticated`required	boolean
`email`	string
`expiresAt`	integer	Epoch ms
`flowPending`	boolean
`flowError`	string

Errors 401 · 403

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl "http://127.0.0.1:7385/auth/chatgpt/status" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

Response 200

{
  "authenticated": true,
  "email": "me@example.com",
  "expiresAt": 1790003600000
}

Start a ChatGPT subscription sign-in

POST/auth/chatgpt/start

Operation startChatGptAuthAuthBearer token

The daemon keeps its own subscription session, separate from Studio's. ChatGPT uses a loopback OAuth redirect, so the callback server must run where the browser is. loopback (default) serves it in the daemon: open authUrl, then poll GET /auth/chatgpt/status. relay (for a remote daemon) keeps the PKCE verifier in the daemon while the caller serves the callback on its own loopback redirectUri (required, loopback only) and posts code + state to /auth/chatgpt/complete within 10 minutes.

Request bodyapplication/json · ChatGptAuthStartRequest · optional

Field	Type	Description
`mode`	string	Where the OAuth callback is served (default loopback) One of `loopback`, `relay`
`redirectUri`	string	Relay mode only, and required there: the caller's own loopback callback URL

Responses

Status Description Body

200 Flow started; open authUrl ChatGptAuthStartResponse

`started`required	boolean	Value `true`
`mode`required	string	One of `loopback`, `relay`
`authUrl`required	string
`callbackPort`	integer	Loopback mode: the port the daemon listens on
`flowId`	string	Relay mode: pass to /auth/chatgpt/complete
`state`	string	Relay mode: echo back with the code
`expiresAt`	integer	Relay mode: epoch ms after which the flow is discarded

Errors 400 · 401 · 403

400	Invalid request: missing or malformed field, query parameter or body. A body Fastify cannot parse gets Fastify's own shape (`statusCode`, `code`, `error`, `message`).`bad_requestFST_ERR_CTP_EMPTY_JSON_BODY`
401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl -X POST "http://127.0.0.1:7385/auth/chatgpt/start" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "mode": "relay",
  "redirectUri": "http://127.0.0.1:1455/auth/callback"
}'

Complete a relayed ChatGPT sign-in

POST/auth/chatgpt/complete

Operation completeChatGptAuthAuthBearer token

Exchanges the code captured by the caller's callback server. Each flowId is single-use and expires 10 minutes after start; an unknown or expired flowId, a mismatched state or a failed token exchange answers 400. After any sign-in (loopback, relay or Grok) every loaded loop in error from an auth failure of that provider type returns to idle and emits agent.recovered; the failed turn is not re-run.

Request bodyapplication/json · ChatGptAuthCompleteRequest · required

Field	Type	Description
`flowId`required	string
`code`required	string	Authorization code from the caller's OAuth callback
`state`required	string

Responses

Status Description Body

200 Signed in ChatGptAuthCompleteResponse

successrequired

boolean

Value true

statusrequired object

5 fields of status · SubscriptionAuthStatus

`authenticated`required	boolean
`email`	string
`expiresAt`	integer	Epoch ms
`flowPending`	boolean
`flowError`	string

recoveredrequired

array<AuthRecovery>

Loops that left error after this sign-in

4 fields of recovered

`agentId`required	string
`filePath`required	string \| null
`loop`required	string
`notice`required	string

Errors 400 · 401 · 403

400	Invalid request: missing or malformed field, query parameter or body. A body Fastify cannot parse gets Fastify's own shape (`statusCode`, `code`, `error`, `message`).`bad_requestFST_ERR_CTP_EMPTY_JSON_BODY`
401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl -X POST "http://127.0.0.1:7385/auth/chatgpt/complete" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"flowId":"string","code":"string","state":"string"}'

Sign out of ChatGPT

POST/auth/chatgpt/logout

Operation logoutChatGptAuthBearer token

No body.

Responses

Status Description Body

200 Signed out SuccessResponse

successrequired boolean

Errors 401 · 403

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl -X POST "http://127.0.0.1:7385/auth/chatgpt/logout" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

Response 200

{
  "success": true
}

Grok (xAI) subscription sign-in status

GET/auth/grok/status

Operation getGrokAuthStatusAuthBearer token

flowPending while a device-code flow runs; a failed flow surfaces flowError.

Responses

Status Description Body

200 Status SubscriptionAuthStatus

`authenticated`required	boolean
`email`	string
`expiresAt`	integer	Epoch ms
`flowPending`	boolean
`flowError`	string

Errors 401 · 403

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl "http://127.0.0.1:7385/auth/grok/status" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

Response 200

{
  "authenticated": true,
  "email": "me@example.com",
  "expiresAt": 1790003600000
}

Start a Grok device-code sign-in

POST/auth/grok/start

Operation startGrokAuthAuthBearer token

OAuth device-code flow (RFC 8628): no localhost callback, so it works against a remote daemon. Open verificationUriComplete (or verificationUri and enter userCode) in any browser, then poll GET /auth/grok/status; the daemon polls xAI in the background. No body.

Responses

Status Description Body

200 Flow started GrokAuthStartResponse

`started`required	boolean	Value `true`
`userCode`required	string
`verificationUri`required	string
`verificationUriComplete`required	string
`expiresIn`required	integer	Seconds

Errors 401 · 403

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl -X POST "http://127.0.0.1:7385/auth/grok/start" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

Response 200

{
  "started": true,
  "userCode": "ABCD-EFGH",
  "verificationUri": "https://accounts.x.ai/device",
  "verificationUriComplete": "https://accounts.x.ai/device?code=ABCD-EFGH",
  "expiresIn": 900
}

Sign out of Grok

POST/auth/grok/logout

Operation logoutGrokAuthBearer token

No body.

Responses

Status Description Body

200 Signed out SuccessResponse

successrequired boolean

Errors 401 · 403

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`

Error bodies use the error format.

Example

Request

curl -X POST "http://127.0.0.1:7385/auth/grok/logout" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"

Response 200

{
  "success": true
}

Attach or update a provider in the agent config

POST/agents/{id}/providers

Operation attachAgentProviderAuthBearer token

Path parameters

Name	Type	Description
`id`required	string	Loaded agent: its id, handle or name. example: agent-1

Request bodyapplication/json · ProviderAttachBody · required

Field Type Description

providerrequired

object

A provider carried in the agent's own config. Its API key is a credential (PUT …/providers/{providerId}/credential), never part of this object.

8 fields of provider · AgentProviderConfig

idrequired

string

anthropic, openai, … or custom:<id>

typerequired

string

One of anthropic, openai, openai-compatible, openrouter

namerequired string

baseUrlrequired string

preset string

defaultModel string

params array<object>

2 fields of params

`key`required	string
`value`required	string

requestDelayMs integer

Responses

Status Description Body

200 Attached ProviderAttachResponse

agentIdrequired

string

Agent id

providerIdrequired string

successrequired

boolean

Value true

alreadyAttachedrequired boolean

configrequired

object

The agent's ADF v0.2 config (adf_config). Only the most used fields are listed; the full shape is the ADF spec's AgentConfig. Secret values never appear here.

25 fields of config · AgentConfig

adf_versionrequired

string

Value 0.2

idrequired

string

Agent id (stable, the daemon addresses the agent by it)

namerequired string

descriptionrequired string

handle string

icon string

staterequired

string

Display (fleet-map) state of an agent

One of active, idle, hibernate, suspended, off

autonomousrequired boolean

autostart boolean

modelrequired object

9 fields of model · ModelConfig

providerrequired

string

Provider id (app provider or one of the agent's own providers)

model_idrequired string

temperature number | null

max_tokens integer | null

top_p number | null

reasoning

object

Provider-agnostic reasoning ("thinking") config

multimodal object

3 fields of multimodal

`image`	boolean
`audio`	boolean
`video`	boolean

params array<object>

2 fields of params

`key`required	string
`value`required	string

provider_params object

instructionsrequired string

contextrequired

object

compact_threshold, audit, dynamic_instructions

toolsrequired

array<object>

Tool declarations

5 fields of tools

`name`required	string
`enabled`required	boolean
`visible`	boolean
`restricted`	boolean
`locked`	boolean

triggersrequired

map<string, TriggerConfig>

on_startup, on_inbox, on_outbox, on_file_change, on_chat, on_timer, on_tool_call, on_task_create, on_task_complete, on_logs, on_llm_call

3 fields of triggers

enabledrequired boolean

targetsrequired array<TriggerTarget>

11 fields of targets

`scope`required	string	One of `agent`, `system`
`lambda`	string	System scope: `path/file.ts:functionName`
`command`	string	System scope: shell command (alternative to lambda)
`warm`	boolean
`filter`	object
`debounce_ms`	integer
`interval_ms`	integer
`batch_ms`	integer
`batch_count`	integer
`locked`	boolean
`loop`	string	Cognition loop this target wakes; absent = main

locked boolean

securityrequired object

limitsrequired object

messagingrequired

object

mode (proactive | respond_only | listen_only), receive, network, …

mcp object

2 fields of mcp

serversrequired array<McpServerConfig>

20 fields of servers

namerequired string

transportrequired

string

One of stdio, http

command string

args array<string>

url string

oauth boolean

headers map<string, string>

header_env array<object>

bearer_token_env_var string

env map<string, string>

env_keys array<string>

env_schema array<object>

npm_package string

pypi_package string

source string

available_tools array<object>

tool_call_timeout_ms integer

restricted boolean

run_location

string

One of host, shared

credential_files array<object>

3 fields of credential_files

`path`required	string
`required`	boolean
`write_back`	boolean

new_tools_restricted boolean

adapters

map<string, AdapterInstanceConfig>

Channel adapters by type

4 fields of adapters

enabledrequired boolean

config

object

Adapter-specific settings (no secrets: tokens are credentials)

policy object

limits object

1 field of limits

max_attachment_size

integer

Bytes

providers array<AgentProviderConfig>

8 fields of providers

idrequired

string

anthropic, openai, … or custom:<id>

typerequired

string

One of anthropic, openai, openai-compatible, openrouter

namerequired string

baseUrlrequired string

preset string

defaultModel string

params array<object>

2 fields of params

`key`required	string
`value`required	string

requestDelayMs integer

loops

array<LoopConfig>

Inner (side) loops; main is implicit

8 fields of loops

`name`required	string	pattern: ^[a-z0-9][a-z0-9_-]{0,31}$
`goal`required	string	Becomes the loop's instructions
`enabled`required	boolean
`autostart`	boolean
`autonomous`	boolean
`model`	object	Fields as in ModelConfig above.
`compact_threshold`	integer \| null
`tools`	array<string>	Absolute allow-list, intersected with the host's enabled tools

ws_connections array<object>

serving object

locked_fields array<string>

metadatarequired

object

created_at, updated_at, author, tags, version

Errors 400 · 401 · 403 · 404 · 500

400	Invalid request: missing or malformed field, query parameter or body. A body Fastify cannot parse gets Fastify's own shape (`statusCode`, `code`, `error`, `message`).`bad_requestFST_ERR_CTP_EMPTY_JSON_BODY`
401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`
404	Unknown agent (or the named resource: loop, task, file, …)
500	Unexpected runtime failure

Error bodies use the error format.

Example

Request

curl -X POST "http://127.0.0.1:7385/agents/agent-1/providers" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "provider": {
    "id": "custom:ab12cd",
    "type": "openai-compatible",
    "name": "Local LLM",
    "baseUrl": "http://127.0.0.1:11434/v1"
  }
}'

Detach a provider and delete its credentials

DELETE/agents/{id}/providers/{providerId}

Operation detachAgentProviderAuthBearer token

Removes the provider config and every provider:{providerId}:* identity row.

Path parameters

Name	Type	Description
`id`required	string	Loaded agent: its id, handle or name. example: agent-1
`providerId`required	string	Provider id in the agent config example: anthropic

Responses

Status Description Body

200 Detached ProviderDetachResponse

`agentId`required	string	Agent id
`providerId`required	string
`success`required	boolean	Value `true`
`deletedCredentials`required	integer
`config`required	object	The agent's ADF v0.2 config (adf_config). Only the most used fields are listed; the full shape is the ADF spec's AgentConfig. Secret values never appear here. Fields as in AgentConfig above.

Errors 401 · 403 · 404 · 500

401	Missing or wrong bearer token (`unauthorized`)
403	The request guard refused it: Host header not allowed (`host_not_allowed`, DNS-rebinding protection) or a browser cross-site request (`cross_origin`)`host_not_allowedcross_origin`
404	Unknown agent (or the named resource: loop, task, file, …)
500	Unexpected runtime failure

Error bodies use the error format.

Example

Request

curl -X DELETE "http://127.0.0.1:7385/agents/agent-1/providers/anthropic" \
  -H "Authorization: Bearer $ADF_DAEMON_TOKEN"