Model providers

Your runner needs at least one model provider — an OpenAI, Anthropic, or other account — before it can answer anything. Provider credentials live on your runner's machine. You can connect a provider on the runner itself, or connect one from Evident: pick it from the list of providers your runner can actually sign in to, and — for a provider whose credentials are already on a machine you control, such as a Claude subscription — hand those credentials to the runner from there too. Evident holds anything you paste only until the runner has collected it. Evident also shows you which providers a runner can use, and warns you when it has none.

Why this matters

A runner with no provider connected still starts and still shows as online — it simply can't call a model, so messages you send it will fail. This is deliberate: connecting a provider is a one-time setup step, and we'd rather not block your runner from starting over it. The CLI warns you at startup when it spots the problem:

Warning: opencode has no authenticated model provider configured, so it won't be
able to answer prompts. Run `opencode auth login` to set one up (see
https://opencode.ai for details).

1. Check what's connected

Open your runner's page in Evident and go to the Model providers tab. It lists every provider the runner can currently call. If there are none, you'll see a No model provider connected warning with links to fix it.

2. Connect a provider on the runner

Providers are connected through OpenCode's own web interface, which Evident proxies for you — so you don't need any command line or container access.

1. From your runner's page in Evident, open the runner's OpenCode UI.
2. Go to Manage models, then Connect a provider.
3. Pick your provider and follow its sign-in. Some providers sign you in through your browser; others ask for an API key.

When you come back to your runner's page in Evident, the provider appears in the Model providers tab as connected.

3. Or connect from the command line

If you'd rather not use the web interface — or you're setting a machine up ahead of time — you can connect a provider directly on your runner's machine:

opencode auth login

Follow the prompts to pick a provider and sign in. See the OpenCode documentation for the providers it supports and the details of each sign-in method.

4. Or connect a provider from Evident

From the runner's page in Evident's Model providers tab, click Connect a provider to open the connect panel. It lists the providers this runner can actually sign in to — the list comes from the runner itself, so it only ever offers you something it can finish. A provider it could only authenticate with an API key never appears here, since Evident has no way to complete that sign-in for you.

Pick a provider, and one of two things happens depending on how it signs in:

• Most providers just need you to authorize them — for some that completes immediately; for others you're shown a web address to open, sign in at, and a code to paste back once you're done.
• A provider that's authenticated by its own desktop tool, which leaves credentials on the machine you signed in from — a Claude subscription (as opposed to an Anthropic API key) works this way — asks you to paste those credentials in first, then authorize. Today Evident knows this shape for Anthropic only; the steps below walk through that case.

If that machine isn't your runner's machine, the credentials have to get there somehow, and opening a shell on the runner isn't always possible or desirable. So a runner can be started allowing Evident to write files into directories you name. With that in place, you paste the credentials into the runner's page in Evident. The runner collects them itself — it checks for queued files every couple of seconds as part of the work it already does — writes them to disk, and tells Evident how it went. Evident deletes its copy the moment the runner acknowledges it.

Step 1 — Allow it when you start the runner (only for providers with a file step)

This is off by default. A runner started without the flag below accepts nothing — and because the runner collects the file rather than Evident pushing it, Evident still offers you the option and reports the refusal after you paste (see "If it doesn't work" below). To turn it on, name each directory Evident may write into:

evident run --enable-file-sync-to ~/.claude

The flag is repeatable — pass it once per directory, up to 16 — and each value must be an absolute path once a leading ~ is expanded. Those values are the whole allow-list: nothing outside them can be written. The directory doesn't have to exist yet; it's created (mode 700) the first time it's needed. On startup the CLI logs the directories it allowed, so you can confirm what you granted. If your provider doesn't need a credentials file, you can skip this step entirely and go straight to authorizing it once you've chosen it in Evident.

Step 2 — Get the credentials off the machine you signed in on

For a Claude subscription, where they live depends on your platform:

• macOS — they're in the Keychain, not in a file. Print them with:

  security find-generic-password -s "Claude Code-credentials" -w

• Linux and Windows — they're the contents of ~/.claude/.credentials.json.

Either the wrapped form ({"claudeAiOauth": {…}}) or the bare object with accessToken / refreshToken / expiresAt is accepted — paste whatever your platform gives you, whole.

Step 3 — Choose the provider and connect it

Open the runner's page in Evident, go to the Model providers tab, and click Connect a provider. If your runner can sign in to more than one provider, choose it from the list first — if there's only one, it's already chosen for you.

For a provider with a credentials-file step (Anthropic today), paste the credentials and submit. Evident checks the shape in your browser first, so a mistyped paste never leaves your machine. Evident shows "waiting for the runner to pick up the credentials" while the runner collects them — usually a second or two. They're written to ~/.claude/.credentials.json on the runner, mode 600, and the runner is then asked to adopt them. No restart is needed — the account is picked up in place, and the provider appears as connected in the section above. If the credentials land but the runner fails to adopt them, Evident says exactly that ("saved on the runner but could not be activated") so you restart the runner rather than pasting again.

For any provider, once there's nothing left to paste you authorize it. If that needs you to visit a website, Evident shows you the address and what to do there — sign in, get a code, and paste it back into Evident. Either way, once the runner adopts the account it appears as connected straight away, with no restart needed.

If it doesn't work

Because the runner collects a credentials file rather than Evident pushing it, Evident can't know in advance whether a given runner will accept one. So, for a provider with a file step, each answer comes back after you paste, from the runner itself, and names the fix:

• "This runner isn't accepting files." It was started without --enable-file-sync-to. Restart it with the flag pointing at ~/.claude.
• "The runner is not allowed to write to that path." It was started with the flag, but naming a different directory. Restart it with --enable-file-sync-to ~/.claude.
• "The runner still hasn't picked up the credentials." Nothing came to collect them within about twenty seconds — usually because the runner is offline. They stay queued: start the runner and it will collect and write them, with no need to paste again.

If authorizing itself fails — with or without a file step before it — Evident says the account could not be activated and asks you to try connecting again.

What the runner will and won't accept

The runner is the last word on what lands on its disk — it re-checks everything rather than trusting Evident:

• Only paths inside a directory you named are written. Traversal (..) is rejected outright, and both the target's parent directory and each allow-listed directory are resolved through symlinks before being compared — so a symlink pointing out of the allow-list fails rather than escaping it.
• Files are written to a fresh temporary file and then renamed over the destination, so an existing link at that path is replaced, never written through.
• Files are created mode 600, directories mode 700.
• A file is capped at 64 KiB, which is far more than any credentials file.

The design, what Evident holds while a file is waiting to be collected, and the residual risks it accepts are recorded in ADR-0053.

Where your credentials live

Provider credentials are stored by OpenCode (or the provider's own tool) on your runner's machine. Evident asks a runner which providers are connected, never for the credentials themselves — the only credentials Evident ever holds are ones you deliberately paste in to hand to a runner. Those are kept just long enough for the runner to collect them: they're deleted as soon as it acknowledges the file (whether it wrote it or refused it), and anything never collected expires within a day. They are never written to a log. While a file is waiting to be collected, it can be read by anyone who already has access to that runner — the same people who can already drive its agent — and by no one else. This is the same principle as the rest of the local runner model: your environment stays yours. A code you paste back to authorize a provider is relayed straight to the runner the same way — Evident never logs or stores it either.

Keeping them across restarts is the runner's own business. On a machine you run yourself, the file simply stays there. A hosted runner that replaces its container needs its own persistence — the reference setup in infrastructure/evident-runner/ syncs the file to S3 and restores it on boot.

Choosing a model

Once a provider is connected, its models become selectable wherever Evident asks for one — for example the model field on a Slack channel, or an inline {provider/model} override in a message. Models from providers you haven't connected are marked as not configured, so you can tell at a glance which ones will actually work.

Next steps

• Local runner — run your runner on your own machine.
• Troubleshooting — fixes for common issues.
• Slack integration — message your runner from Slack.