Put Hermes Agent credentials in ~/.hermes/.env, not in your project files. The quickest supported setup is hermes config set PROVIDER_KEY your-key, followed by hermes model to configure and select a provider. Use /model only inside an active chat when the provider has already been configured.
Antihost offers VPS plans with one-click Hermes Agent, NVMe storage and a 14-day free trial.
Where Hermes Agent stores API keys
Hermes separates secrets from ordinary behavior settings:
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
~/.hermes/.env: API keys, bot tokens, OAuth secrets and other credentials.~/.hermes/config.yaml: non-secret preferences and provider behavior settings when a configuration key exists for them.
This separation keeps credentials out of the main YAML configuration and makes it easier to protect the secret file with normal home-directory permissions. Do not paste a real key into an article, issue, screenshot or public repository, and do not commit .env to source control.
The files are per-user because the ~ in the path means the home directory of the account running Hermes. If Hermes is launched by another account, a service manager or a container, that process must have the corresponding environment or home directory. Saving a key as one user and launching Hermes as another is a common reason for an apparently missing credential.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
What you need before starting
Have the following ready before opening the setup wizard:
- An installed Hermes Agent command that responds to
hermesin your shell. - An account with a provider that Hermes supports, or a service exposing an OpenAI-compatible API.
- Either the provider’s API key, a supported OAuth login, or reusable credentials such as Claude Code credentials.
- For a custom service, the exact base URL, authentication requirement and model identifier supplied by that service.
- Permission to write to your own
~/.hermesdirectory.
You do not need to put every setting in one file. Credentials stay in .env; model preferences, provider selection and other non-secret behavior can live in config.yaml. Keeping those roles separate makes it easier to rotate a key without rewriting model configuration.
The fastest first-time setup
Choose the provider you intend to use, then run its documented environment-variable command. For example, OpenRouter uses OPENROUTER_API_KEY:
hermes config set OPENROUTER_API_KEY sk-or-your-key
hermes modelReplace the example value with your actual key locally. The hermes config set command automatically routes API-key values to ~/.hermes/.env; other settings are written to ~/.hermes/config.yaml. This is safer than manually guessing which file should contain a value.
- Install and launch Hermes Agent so the
hermescommand is available. - Run
hermes config setwith the exact variable name required by your provider. - Run
hermes modeloutside an existing chat session. - Choose the provider, authenticate with its API key or OAuth flow, and select a model or endpoint when prompted.
- Start a chat and send a small test request before doing longer work.
“You need at least one way to connect to an LLM.” If no provider credential or OAuth connection is configured, Hermes cannot make model requests.
Use a harmless test prompt first. A successful provider selection does not prove that every model is enabled for your account, so a short request is the quickest way to distinguish an authentication problem from a model-access or endpoint problem.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemshermes model versus /model
| Command | Where you run it | What it does | When to use it |
|---|---|---|---|
hermes model |
Shell, outside a chat | Runs the full provider setup wizard; it can add a provider, run OAuth, accept an API key and configure an endpoint. | First-time setup or whenever the provider has never been configured. |
/model |
Inside an existing Hermes chat | Switches among providers and models that are already configured. | Changing an active session to an available, previously configured model. |
If the provider you want does not appear in /model, leave the chat and run hermes model. The slash command is a selector, not a replacement for initial credential setup.
This distinction also explains why entering a new key while chatting does not normally make a new provider appear immediately. The wizard records the provider and its authentication method; the in-chat command then reads that configured list. Run the wizard again whenever you add a provider, change OAuth credentials or introduce a custom endpoint.
Provider credential names
Provider variable names are specific and should be treated as case-sensitive. A key stored under the wrong name is effectively invisible to the provider that expects another name.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Provider or route | Credential or configuration | Important setup detail |
|---|---|---|
| OpenRouter | OPENROUTER_API_KEY |
Use this variable for the OpenRouter route, then configure it through hermes model. |
| OpenAI or another OpenAI-compatible service | OPENAI_API_KEY and, when needed, OPENAI_BASE_URL |
If OPENAI_BASE_URL is set, Hermes sends the key to that exact endpoint origin. |
| Anthropic | ANTHROPIC_API_KEY, Claude Code credentials, or the ANTHROPIC_TOKEN fallback |
The interactive hermes model route is preferred for Claude credentials. |
| GitHub Copilot | COPILOT_GITHUB_TOKEN, then GH_TOKEN, then GITHUB_TOKEN, or gh auth token |
Classic ghp_* tokens are not supported by the Copilot API; use OAuth or a supported fine-grained token. |
| Google Gemini | GOOGLE_API_KEY or GEMINI_API_KEY |
Gemini can also be selected for auxiliary tasks. |
| z.ai / GLM | GLM_API_KEY |
Select the zai provider. |
| Kimi / Moonshot | KIMI_API_KEY for the international service or KIMI_CN_API_KEY for China |
Select the provider variant that matches the key and service region. |
The current Hermes environment-variable catalog also covers providers such as MiniMax, Kilo Code, Xiaomi MiMo, DeepSeek, Hugging Face and Alibaba Cloud. Use the exact variable documented for the provider you select rather than assuming that an OpenAI-style name will work everywhere.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When a provider offers two names, such as Gemini’s GOOGLE_API_KEY and GEMINI_API_KEY, use the name recognized by the provider entry you select. For region-specific services, the key and provider variant must agree; an international key will not automatically become a China-region key, and vice versa.
Configuring OpenRouter
Save the key
hermes config set OPENROUTER_API_KEY sk-or-your-keyThe command writes the secret to ~/.hermes/.env. Keep the key value private and avoid putting it directly in shell history when your environment records command lines. If shell history is retained, clear the line after setup or prefer the interactive prompt in hermes model when available.
Complete provider setup
hermes modelUse the wizard to add or select the OpenRouter provider and choose the model you want Hermes to use. Once the provider is configured, an active chat can use /model to switch among the models Hermes already knows about.
OpenRouter is useful when you want a hosted route with multiple model choices behind one provider configuration. The key still belongs exclusively in .env; model selection and other non-secret preferences can be adjusted through the wizard or YAML configuration.
Configuring OpenAI and OpenAI-compatible endpoints
A standard OpenAI connection normally needs OPENAI_API_KEY. A compatible service at another host additionally needs OPENAI_BASE_URL:
hermes config set OPENAI_API_KEY your-key
hermes config set OPENAI_BASE_URL https://api.example.test/v1
hermes modelThe base URL determines where Hermes sends requests. When it is set, Hermes sends the key to that exact endpoint origin, so verify the origin, path and service documentation before testing. Do not assume that every compatible service uses the same path, model names or authentication behavior as OpenAI.
You can also configure a custom endpoint directly in the setup wizard. This is useful when the service does not have a dedicated provider entry or when you need to select a non-default endpoint interactively.
Custom endpoint checklist
- Confirm whether the service expects a versioned path such as
/v1; copy the complete base URL exactly. - Store the service credential under
OPENAI_API_KEYunless the provider documentation specifies another variable. - Set
OPENAI_BASE_URLto the service origin and required path, without substituting a dashboard URL or unrelated web address. - Run
hermes modeland select the custom route. - Test with a model name that the service actually exposes. OpenAI-compatible syntax does not guarantee identical model IDs or feature support.
If the service uses a different authentication header or does not implement the expected OpenAI-compatible API shape, selecting an OpenAI-compatible route will not correct that mismatch. In that case, use a dedicated Hermes provider entry if one exists.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Using environment substitution in config.yaml
Hermes supports variable references in YAML. The supported form uses braces:
model:
provider: custom
base_url: ${OPENAI_BASE_URL}
api_key: ${OPENAI_API_KEY}${VAR_NAME} is expanded from the environment. Bare $VAR is not expanded, so changing the syntax can leave Hermes with a literal, unusable value. Keep the actual key in ~/.hermes/.env or the process environment and reference it from YAML rather than embedding the secret in the file.
For an auxiliary task, set its base_url to the custom service and provide its api_key or OPENAI_API_KEY. Hermes then calls that endpoint directly with the configured credential.
After editing YAML, run hermes config check. This catches configuration syntax and reference mistakes before you spend time diagnosing an API response. If the check succeeds but a variable is still literal, inspect the spelling and braces in the reference and confirm the variable is available to the process that starts Hermes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Anthropic, Copilot and other authentication routes
Anthropic
Hermes accepts an ANTHROPIC_API_KEY. It can also reuse Claude Code credentials or fall back to ANTHROPIC_TOKEN. For an interactive setup, run hermes model and follow the Claude credential prompts instead of manually moving credentials between files.
GitHub Copilot
Hermes checks COPILOT_GITHUB_TOKEN, then GH_TOKEN, then GITHUB_TOKEN, and can also use gh auth token. A classic ghp_* token is not supported by the Copilot API. Use the OAuth device flow or a supported fine-grained token instead.
Google Gemini, GLM and Kimi
Gemini accepts GOOGLE_API_KEY or GEMINI_API_KEY and may be selected for auxiliary work as well as a primary model. The z.ai route uses GLM_API_KEY and is selected as the zai provider. Kimi uses KIMI_API_KEY for the international service and KIMI_CN_API_KEY for China; choose the provider variant matching the credential’s region.
OAuth providers
An API key is not mandatory for every provider. The setup wizard documents Nous Portal and OpenAI Codex OAuth, GitHub Copilot OAuth device login and Claude Code credential reuse for Anthropic. Run hermes model to start the supported OAuth flow; do not paste an OAuth secret into a public configuration file.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOAuth is often the cleaner choice when a provider supplies it because Hermes can complete the browser or device authorization flow and reuse the resulting credentials. It does not change the command distinction: OAuth setup still belongs in hermes model, while /model only selects a route that is already configured.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Primary models and auxiliary tasks
Hermes can use one provider for the main conversational model and another for an auxiliary task. For example, Gemini may be selected for an auxiliary operation while your primary chat uses OpenRouter. Treat each route as a separate configuration: verify its provider name, key variable and, for a custom service, its base URL.
When an auxiliary task has a base_url, Hermes calls that endpoint directly and authenticates with the configured api_key or OPENAI_API_KEY. A working primary provider therefore does not prove that an auxiliary endpoint is reachable. Test each configured route that your workflow depends on.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Checking and troubleshooting a failed setup
Work through these checks in order. Each one eliminates a different class of configuration error.
- Confirm the exact variable name.
OPENROUTER_API_KEYis not interchangeable withOPENAI_API_KEY, and region-specific names such asKIMI_CN_API_KEYmatter. - Confirm where the value was saved. The secret should be in
~/.hermes/.envor exported into the environment of the process launching Hermes. Ordinary behavior settings belong in~/.hermes/config.yaml. - Inspect Hermes configuration. Run
hermes configto inspect the effective configuration, then runhermes config checkafter edits. - Use the correct command for the situation. If a provider has never been configured, exit the chat and run
hermes model. Use/modelonly after the provider appears among configured choices. - Validate a custom endpoint. Check both
OPENAI_BASE_URLand the matching key. In YAML, use${OPENAI_BASE_URL}, not$OPENAI_BASE_URL. - Check the service and region. A key can be valid but unusable for the selected provider variant, account, model or endpoint region.
Symptom: Hermes says no provider is configured
Usually the key was saved under an unsupported variable name, saved for a different user account, or the shell running Hermes cannot read the file. Run hermes config, verify the expected variable name and location, then repeat the setup with hermes model.
Symptom: the provider is missing from /model
This means the provider is not configured for the current Hermes installation or profile. Leave the chat and run hermes model; the slash command cannot add a new provider.
Symptom: authentication fails against a custom service
Check the complete base URL first. A compatible API may require a particular path or origin. Then verify that the key belongs to that service and that the YAML references use brace syntax. If the endpoint is configured through the wizard, compare its saved value with the service’s required endpoint.
Symptom: a YAML variable appears empty or literal
Replace bare references such as $OPENAI_API_KEY with ${OPENAI_API_KEY}. Ensure the variable is present in ~/.hermes/.env or exported before Hermes starts.
Symptom: a key works in one terminal but not another
Check which account and home directory each terminal uses and whether Hermes was started by a different process or service. The credential must be in that process’s environment or in the matching user’s ~/.hermes/.env. Re-run hermes config set as the account that will actually launch Hermes.
Symptom: the key is accepted but a model request fails
Separate authentication from availability. Confirm that the selected model is enabled for the account, that the provider variant matches the key’s region, and that a custom endpoint supports the requested model and API operation. A valid key alone does not guarantee access to every model.
Security practices that prevent key leaks
- Keep credentials in
~/.hermes/.envand protect the file with your operating system’s account permissions. - Never commit
.envor a YAML file containing a literal key to source control. - Redact secrets from terminal transcripts, screenshots, bug reports and chat logs.
- Use separate keys when your provider supports it, so a leaked development credential can be revoked without disrupting every environment.
- When a key is exposed, revoke or rotate it at the provider immediately and replace the value with
hermes config set. - Do not treat a custom endpoint as a security boundary: Hermes will send the configured credential to the base URL you provide.
Also review copied commands before sharing them. A command containing the complete key can leak through shell history, CI logs or terminal recording even when the file itself is protected. Use placeholders in documentation and verify that diagnostic output does not print secret values.
A practical setup decision guide
| Your situation | Recommended route | Credential handling |
|---|---|---|
| You have a provider API key and no custom host | Save the provider’s exact variable with hermes config set, then run hermes model. |
Key goes to ~/.hermes/.env. |
| You want to switch models during a chat | Use /model. |
Only already configured providers and models are available. |
| You need a service with an OpenAI-compatible API | Set OPENAI_API_KEY and OPENAI_BASE_URL, or add the endpoint through hermes model. |
Keep both values separate; reference them with ${...} in YAML. |
| Your provider supports OAuth | Run hermes model and choose its OAuth flow. |
Hermes stores and reuses the resulting credentials instead of requiring a copied API key. |
| You are configuring an auxiliary model | Set its provider, base_url and key in the relevant configuration. |
Hermes calls the specified endpoint directly with the configured key. |
Use the API-key route when you already have a provider credential and need a predictable environment-variable setup. Choose OAuth when Hermes documents a flow for that provider and you prefer not to copy a key. Choose a custom endpoint only when you know the service’s exact origin and compatibility requirements; it gives you routing control but adds URL and model-name checks.
What to remember
- Secrets belong in
~/.hermes/.env; non-secret behavior settings belong in~/.hermes/config.yaml. hermes config set KEY VALUEis the supported convenience command that routes API keys and ordinary settings to the appropriate file.hermes modelperforms first-time provider setup;/modelonly switches among configured choices.- Use the provider’s exact variable name, including capitalization and regional variants.
- Custom OpenAI-compatible services use
OPENAI_BASE_URLwith an API key, and YAML substitution requires${VAR_NAME}. - OAuth means some supported providers can be connected without manually entering an API key.
Frequently Asked Questions
Where do I put my Hermes Agent API key?
Save it in ~/.hermes/.env, preferably with hermes config set PROVIDER_KEY your-key. Do not place a real secret in config.yaml, project files or source control.
Should I use hermes model or /model?
Use hermes model in your shell for first-time provider setup, API-key entry, OAuth or custom endpoints. Use /model inside a chat only to switch among providers and models that are already configured.
Why does my provider not appear in /model?
The provider has not been configured for that Hermes profile. Exit the chat and run hermes model; the slash command cannot add a new provider.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can Hermes use a custom OpenAI-compatible endpoint?
Yes. Set OPENAI_API_KEY and OPENAI_BASE_URL, or add the endpoint through hermes model. In YAML, reference them as ${OPENAI_API_KEY} and ${OPENAI_BASE_URL}; bare $VAR is not expanded.
Do I always need an API key?
No. Hermes documents OAuth for Nous Portal, OpenAI Codex and GitHub Copilot, and can reuse Claude Code credentials for Anthropic. Start those flows with hermes model.
Which token can I use for GitHub Copilot?
Hermes checks COPILOT_GITHUB_TOKEN, then GH_TOKEN, then GITHUB_TOKEN, or the output of gh auth token. Classic ghp_* tokens are not supported by the Copilot API; use OAuth or a supported fine-grained token.
How do I configure Gemini, GLM or Kimi?
Gemini accepts GOOGLE_API_KEY or GEMINI_API_KEY. z.ai/GLM uses GLM_API_KEY and the zai provider. Kimi uses KIMI_API_KEY internationally or KIMI_CN_API_KEY in China; select the matching provider variant.
What should I check after changing a key or YAML file?
Run hermes config to inspect the effective configuration and hermes config check after edits. Then run hermes model if the provider was newly added and send a small test request.
The Bottom Line
For most setups, run hermes config set with the provider’s exact variable name, let Hermes save the secret in ~/.hermes/.env, and finish with hermes model. Use /model only for switching configured choices. For custom services, verify OPENAI_BASE_URL and use ${VAR_NAME} in YAML; for supported providers, OAuth can replace manual API-key entry.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
