Authenticating Your AI Assistant

Before PumasAide can be useful, your AI coding assistant must be logged in to a model backend. This is separate from connecting the assistant to the PumasAide MCP server (see Getting Started with PumasAide). PumasAI does not provide model access; you bring your own subscription, API key, or cloud-provider account.

Pick the path that matches your org's policy. Many regulated environments (pharma, healthcare) require inference to route through an existing AWS, GCP, or Azure contract rather than calling a vendor SaaS directly.

Choosing a backend

Claude Code

Anthropic API or Claude subscription (default)

Run claude for the first time and follow the interactive login. Alternatively:

export ANTHROPIC_API_KEY=sk-ant-...

See Claude Code setup.

Amazon Bedrock

Enable Bedrock and set the region:

export CLAUDE_CODE_USE_BEDROCK=1
export AWS_REGION=us-east-1

Then pick one credential source.

• SSO (typical for regulated orgs):

  aws sso login --profile my-profile
  export AWS_PROFILE=my-profile

• Static IAM keys: run aws configure once to write keys to ~/.aws/credentials.

• Bedrock-only API key: export AWS_BEARER_TOKEN_BEDROCK=.... Narrower than full AWS credentials; works only for Bedrock.

• Attached instance role on EC2/ECS/EKS: nothing to set; the AWS SDK reads the role from instance metadata. Applies only when the role lives in the AWS account whose Bedrock you want to call and the host exposes the metadata service to your container.

Claude Code uses the standard AWS SDK credential chain, so the first source it finds wins.

See Claude Code on Amazon Bedrock.

Google Vertex AI

export CLAUDE_CODE_USE_VERTEX=1
export CLOUD_ML_REGION=global
export ANTHROPIC_VERTEX_PROJECT_ID=your-project-id

gcloud auth application-default login
# Or: export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa-key.json
# Or: workload identity / attached service account on GCE/GKE.

To auto-refresh stale ADC tokens, add this to your settings.json:

{
  "gcpAuthRefresh": "gcloud auth application-default login"
}

See Claude Code on Google Vertex AI.

Microsoft Foundry (Azure)

az login

export CLAUDE_CODE_USE_FOUNDRY=1
export ANTHROPIC_FOUNDRY_RESOURCE=your-foundry-resource
# Optional: API key instead of Entra ID
# export ANTHROPIC_FOUNDRY_API_KEY=...

Claude Code uses the Azure SDK default credential chain after az login. No separate API key needed.

See Claude Code on Microsoft Foundry.

Internal LLM gateway

Use this path when your org fronts model inference with a corporate proxy (LiteLLM, an internal gateway, etc.) for central auth, audit logging, or cost tracking. Claude Code talks to the gateway directly. No vendor cloud credentials are required on the client.

Point Claude Code at the gateway:

export ANTHROPIC_BASE_URL=https://llm-gateway.your-org.example

Then pick one credential source.

• Static bearer token:

  export ANTHROPIC_AUTH_TOKEN=your-gateway-token

  Sent as the Authorization header on every request.

• Rotating or per-session token via apiKeyHelper. Add to ~/.claude/settings.json:

  {
    "apiKeyHelper": "/path/to/get-token.sh",
    "env": {
      "CLAUDE_CODE_API_KEY_HELPER_TTL_MS": "3600000"
    }
  }

  The helper is any executable that prints a token to stdout (vault fetch, internal CLI, JWT mint). CLAUDE_CODE_API_KEY_HELPER_TTL_MS sets the refresh interval (here, one hour).

If the gateway needs extra headers (tenant ID, project tag), set them with ANTHROPIC_CUSTOM_HEADERS.

See Claude Code LLM gateway configuration.

OpenAI Codex CLI

OpenAI / ChatGPT (default)

codex login           # OAuth (ChatGPT subscription) or API key prompt
# Or:
export OPENAI_API_KEY=sk-...

See Codex CLI Authentication.

Azure OpenAI

Add a custom provider to ~/.codex/config.toml:

model = "gpt-5-codex"
model_provider = "azure"

[model_providers.azure]
name = "Azure OpenAI"
base_url = "https://YOUR_RESOURCE.openai.azure.com/openai/v1"
env_key = "AZURE_OPENAI_API_KEY"
wire_api = "responses"

Then:

export AZURE_OPENAI_API_KEY=...
codex

See Azure Foundry: Codex with Azure OpenAI.

GitHub Copilot CLI

GitHub-hosted Copilot

copilot login

Or supply a token via environment variable (priority order: COPILOT_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKEN):

export COPILOT_GITHUB_TOKEN=gho_...

Accepted token prefixes: gho_, github_pat_, ghu_. Classic PATs (ghp_) are rejected.

GitHub Enterprise Cloud with data residency

copilot login --host HOSTNAME

See Authenticating GitHub Copilot CLI.

Enterprise considerations