managing-nemoclaw-providers

name	managing-nemoclaw-providers
description	Manages credential providers for NemoClaw sandboxes — create, inspect, update, and delete API key providers for NVIDIA, Claude, GitHub, OpenAI, Ollama, and generic APIs. Use when setting up inference credentials, API access, or rotating keys for NemoClaw.

Managing NemoClaw Providers

NemoClaw uses OpenShell credential providers to inject API keys and configuration into sandboxed containers. Running nemoclaw onboard registers the initial NVIDIA provider automatically. These commands manage additional providers for other services.

All provider management happens from the host — the user's machine where Claude Code runs.

Provider Types

Five provider types are supported: claude, nvidia, github, openai, and generic. Each type maps to specific environment variables that are injected into the sandbox at runtime.

Quick Reference

Create a provider from existing environment variables

openshell provider create --name <name> --type <type> --from-existing

Reads the appropriate environment variable (e.g., ANTHROPIC_API_KEY for claude, GITHUB_TOKEN for github) from the current shell and stores it in the provider.

Create a generic provider with explicit credentials

openshell provider create --name <name> --type generic --credential KEY=value

Stores the key-value pair as a credential. Multiple --credential flags can be passed.

Create a provider with an environment variable (prompts for value)

openshell provider create --name <name> --type generic --credential API_KEY

When no =value is supplied, the CLI prompts interactively for the value.

Create a GitHub provider from environment

GITHUB_TOKEN=ghp_xxxx openshell provider create --name my-github --type github --from-existing

Sets the token inline so it is available for --from-existing to capture.

Set up Ollama as an OpenAI-compatible provider

openshell provider create --name ollama --type openai \
  --credential OPENAI_API_KEY=empty \
  --config OPENAI_BASE_URL=http://host.openshell.internal:11434/v1

Uses the openai type with a custom base URL pointing to the host-side Ollama instance. The special hostname host.openshell.internal resolves to the host from inside the sandbox.

List all providers

openshell provider list

Inspect a specific provider

openshell provider get <name>

Displays provider type, stored credentials (masked), and configuration.

Update a provider

openshell provider update <name> --type <type> --from-existing

Replaces stored credentials with current environment values. Useful for key rotation.

Delete a provider

openshell provider delete <name>

Removes the provider and its stored credentials. Active sandboxes using this provider will lose access on next restart.

Provider Lifecycle

The typical lifecycle for a credential provider follows this sequence:

1. Create -- Register the provider with credentials via provider create.
2. Verify -- Confirm injection with provider get <name> and test from inside the sandbox.
3. Update -- Rotate or replace credentials with provider update.
4. Delete -- Remove the provider when access is no longer needed.

Providers persist across sandbox restarts. Credentials are stored in ~/.nemoclaw/credentials.json on the host.

Switching Inference Providers

Separate from credential providers, NemoClaw supports switching the active inference backend at runtime via OpenShell:

# Switch to NVIDIA Cloud
openshell inference set --provider nvidia-nim --model nvidia/nemotron-3-super-120b-a12b

# Switch to Local vLLM
openshell inference set --provider vllm-local --model nvidia/nemotron-3-nano-30b-a3b

# Switch to Local NIM
openshell inference set --provider nim-local --model nvidia/nemotron-3-super-120b-a12b

# Check current config
openshell inference get

# Partial update (model only)
openshell inference update --model nvidia/nemotron-cascade-2-30b-a3b

No sandbox restart is required when switching providers.

Detailed Reference

Provider type reference: See provider-types.md for environment variable mappings, usage notes, and configuration options for each provider type.