~/.qwed/providers.yaml. Once registered, they appear as options in the qwed init wizard and work with qwed verify just like built-in providers.
How it works
Custom providers follow the same security model as built-in ones:- The YAML file stores the name of the environment variable that holds your API key, never the key itself.
- The file is written with
0600permissions (owner-read/write only on Unix). - When you select a custom provider in
qwed init, it maps to theopenai_compatinference engine internally, so no changes are needed to your verification workflow.
Define a custom provider
Create or edit~/.qwed/providers.yaml:
Required fields
| Field | Description |
|---|---|
base_url | The provider’s OpenAI-compatible base URL |
api_key_env | Name of the environment variable that stores your API key |
Optional fields
| Field | Default | Description |
|---|---|---|
default_model | gpt-4o-mini | Model name used when none is specified |
models_endpoint | /models | Path to the provider’s model listing endpoint |
auth_header | Authorization | HTTP header used for authentication |
auth_prefix | Bearer | Prefix added before the token value |
qwed init and your custom provider appears alongside the built-in options.
Import a community provider
Instead of writing YAML by hand, you can import a provider definition from a URL:~/.qwed/providers.yaml. After importing, the provider is immediately available in qwed init.
Only
http and https URLs are accepted. The download has a 10-second timeout. The imported YAML must contain base_url and api_key_env fields or it is rejected.Example community YAML
A valid community provider file looks like this:providers wrapper):
Use a custom provider
Once a custom provider is registered:Run the init wizard
.env as usual.Multiple providers
You can define as many providers as you need in the same file:qwed init wizard.
Security
- No secrets in YAML. The config file only stores the name of the env var (e.g.,
GROQ_API_KEY), not the actual key. Secrets live in your.envfile, which is protected by0600permissions and.gitignore. - Atomic writes. The YAML file is written atomically with a temp-file-and-rename pattern to prevent partial writes.
- Slug sanitization. Imported provider slugs are sanitized to lowercase alphanumeric characters and cannot shadow built-in provider names.
- Symlink protection. File writes refuse to follow symlinks.
Related docs
- LLM configuration — set up built-in providers
- CLI reference — full command reference including
qwed provider import - Self-hosting guide — deploy QWED with your own infrastructure