BYOK — Bring Your Own Key
Umbra never proxies your requests. Every call goes directly from your machine to the provider you choose. Your API key is stored locally in ~/.umbra/providers.json and is never transmitted to any Umbra service.
Supported providers
Section titled “Supported providers”| Provider | Key required | Notes |
|---|---|---|
| OpenAI | Yes | gpt-4o, o3, etc. |
| Anthropic | Yes | claude-opus-4, claude-sonnet-4, etc. |
| Mistral | Yes | mistral-large, codestral, etc. |
| Ollama | No | Local; set baseUrl to http://localhost:11434 |
| LM Studio | No | Local; set baseUrl to http://localhost:1234 |
| OpenCode Zen | No | Free cloud models; default on first launch |
| Any OpenAI-compatible | Optional | Point baseUrl at any proxy or self-hosted endpoint |
Connecting a provider
Section titled “Connecting a provider”umbra providers connectThis opens an interactive form. Fill in the provider type, your API key, and (optionally) a custom base URL and model. The profile is saved immediately and set as the default.
To manage profiles after the fact:
umbra providers list # see all configured profilesumbra providers use <id> # change the active profileumbra providers remove <id> # remove a profileSupplying keys via environment variables
Section titled “Supplying keys via environment variables”Some web-search providers also read keys from the environment at startup, so you can inject them without touching any file:
BRAVE_SEARCH_API_KEY=...TAVILY_API_KEY=...JINA_API_KEY=...Switching providers at any time
Section titled “Switching providers at any time”Umbra resolves the active provider at the start of each task. Change the default profile and the very next task uses the new one — no restart required.