OriginRouter Platform
OriginRouter CLIProvider reference

Provider reference

The provider commands manage local Proxy providers on the current device. OriginRouter Cloud and remote devices are sign-in-backed route sources and are not created with provider add.

Use App Provider Control to add providers, enable models, or inspect remote permissions in an interface.

Lifecycle

CommandEffectRecommended verification
provider add <name>Create a local providerInspect it with show, then run doctor provider
provider update <name>Update only explicitly supplied fieldsReview warnings and the redacted result
provider listList local providersConfirm names; inspect model enablement in Provider Control/Local API
provider show <name>Show configuration with masked secretsOriginal secrets are never returned
provider use <name> [--agent ...]Write the provider into a Claude or Codex routeRun route show afterward
provider remove <name>Remove a local providerFirst verify that no effective route references it

--force remains accepted by provider use for older scripts, but it does not change current route safety checks.

Common flags

FlagPurpose
--type proxyLocal proxy. The legacy litellm value is normalized to proxy
--engine litellmCurrent local-provider engine
--litellm-provider <id>Provider identifier such as openai, anthropic, or bedrock
--base-url <url>Upstream API root
--model <id>Default model
--small-fast-model <id>Legacy Claude fast-model field. routes.claude.small is now authoritative
--api-key <value>, --auth-token <value>Upstream authentication
--organization <id>, --api-version <value>Provider-specific organization or API version

Store an environment reference instead of a secret value when possible:

originrouter provider add team-openai \
  --type proxy \
  --engine litellm \
  --litellm-provider openai \
  --api-key os.environ/OPENAI_API_KEY \
  --model gpt-5.4

The variable name is stored verbatim and the proxy runtime resolves it at startup. Secret fields are masked in CLI and Local API output.

Cloud-provider fields

Provider familyFlags
AWS Bedrock / SageMaker--aws-region, --aws-access-key-id, --aws-secret-access-key, --aws-session-token, --aws-profile-name, --aws-bedrock-runtime-endpoint, --aws-role-name, --aws-session-name, --aws-web-identity-token, --aws-sts-endpoint, --sagemaker-base-url
Google Vertex AI--vertex-project, --vertex-location, --vertex-credentials, --google-application-credentials
Azure--azure-ad-token, combined with --base-url and --api-version when required
Hugging Face--hf-token

AWS workload-identity example:

originrouter provider add bedrock-irsa \
  --type proxy \
  --engine litellm \
  --litellm-provider bedrock \
  --aws-region os.environ/AWS_REGION_NAME \
  --aws-role-name arn:aws:iam::123456789012:role/OriginRouterBedrock \
  --aws-web-identity-token os.environ/AWS_WEB_IDENTITY_TOKEN_FILE \
  --model anthropic.claude-3-5-sonnet-20241022-v2:0

Validation and recovery

  1. Run originrouter provider show <name> to inspect normalization (secrets are redacted).
  2. Run originrouter doctor provider <name> to check fields and inference readiness.
  3. Write the route with originrouter route set or provider use.
  4. Run originrouter route show claude|codex to inspect the effective route; inspect model enabled and remoteEnabled in App Provider Control or the Local API.
  5. Restart the proxy and send one real model request.

An unknown flag error means the current provider catalog does not accept that field. If a provider has no enabled model, add or enable one first. For a failed environment reference, verify the variable in the same user environment that starts the proxy or service.

Was this page helpful?