API keys

Besides subscriptions, each tool accepts an API key. The subscription comes first; the key only comes in when the subscription fails or hits its limit, because a key is billed per use. OpenRouter works with a key only.

Cursor uses the account login first (cursor-agent login) and only then the keys. DeepSeek, like OpenRouter, works only with a key and masks personal data before sending. Groq and Cerebras don't answer questions: they only classify each request (for free) and check whether a queued request has already been answered.

ai [auto] › /key claude
Chave de claude (console.anthropic.com/settings/keys). Cole e tecle Enter; ela não aparece na tela.
>
✓ Chave de claude salva em ~/.config/smart-ai/keys/claude (permissão 600).

Keys are stored in ~/.config/smart-ai/keys/, one per file, with permission 600, and are passed only to the tool's process, never to the history or the log. If the variable is already set in the environment, it takes precedence. /key lists what is configured, showing only the start and end of each key.

On Claude, the key works as an extra account after all the subscriptions: if it also hits its limit, it goes on cooldown like the others.

Never paste a key as a shell command. It gets recorded in the zsh history. If that happens, revoke the key on the tool's website and delete the line from ~/.zsh_history.

On OpenRouter the default is free models only: the client picks up to three :free variants from the catalog and uses openrouter/free as a last alternative. Paid models stay blocked until you authorize them:

/model openrouter_paid on            # authorizes; warns it will be billed to your account
/model openrouter anthropic/claude-opus-5.5
/model openrouter_paid off           # blocks again and goes back to free

With authorization on, the chosen model goes first and free models stay as backup. With it off, a zero price cap is sent on every call, so no paid model answers.