Bring your own AI key

Connect a provider locally

Keep API keys in your application repository's local environment or your CI secret store. QA generation and security triage have separate provider settings. You can use the same provider and key for both.

AI_PROVIDER=openrouter
AI_MODEL=z-ai/glm-5.3-flash
SECURITY_TRIAGE_PROVIDER=openrouter
SECURITY_TRIAGE_MODEL=z-ai/glm-5.3-flash
OPENROUTER_API_KEY=your-provider-key

This setup needs no native OpenAI, Anthropic, or Abliteration key. Remove any stale AI_API_KEY or inline ai.api_key override so QA uses your OpenRouter key too. Do not commit your .env file to version control.

Choose each provider explicitly

norybot init selects the QA provider. Security triage defaults to Abliteration until you set SECURITY_TRIAGE_PROVIDER; it does not inherit your QA choice. SECURITY_TRIAGE_MODEL chooses its model, and triage reads that provider's own key variable.

Native providers also work: use openai with OPENAI_API_KEY, anthropic with ANTHROPIC_API_KEY, or abliteration with ABLITERATION_API_KEY. Choose a model supported by that provider. Model usage is billed by each provider separately from your NoryBot license.

What uses AI

QA page and test context goes to the QA provider. Optional security triage sends selected, redacted findings to the separately configured security provider. These destinations can differ. Model-driven investigation uses the security provider unless you override it for that command. Redaction reduces exposure; review whether client or application data is appropriate for the chosen provider account.

norybot scan code --path ./src --skip-triage