Global credentials (cyberine from any directory)

Credentials load with precedence shell env > ~/.cyberine/.env (global, trusted) > ./.env (cwd); a key already set is never overridden. The global ~/.cyberine/.env is what lets the installed cyberine CLI (cyberine chat, cyberine run) find its provider keys no matter which project directory you launch it from — without it, running cyberine inside an unrelated repo picks up THAT repo's .env and falls back to whatever single key happens to be exported in your shell (a common cause of an unexpected OpenRouter 402 when DeepSeek-direct was intended). The global file loads FIRST and wins on purpose: an untrusted project .env can only fill values the global file left unset, so it can never override a global API key or *_BASE_URL to redirect your credential elsewhere — keep your keys AND their base URLs in the global file. Put your provider keys there once:

mkdir -p ~/.cyberine && chmod 700 ~/.cyberine
# DEEPSEEK_API_KEY / MOONSHOT_API_KEY / OPENROUTER_API_KEY / ANTHROPIC_API_KEY ...
$EDITOR ~/.cyberine/.env && chmod 600 ~/.cyberine/.env

Or use the built-in cyberine auth command instead of hand-editing — it validates the key against the provider before writing, preserves your other keys, and chmods the file for you:

cyberine auth                    # interactive menu: pick a provider, paste key, pick model (TTY only)
cyberine auth login deepseek     # prompts, live-validates, writes DEEPSEEK_API_KEY to ~/.cyberine/.env (600)
cyberine auth list               # configured providers, key tails MASKED (sk-...bfe6)
cyberine auth status             # all providers with auth-method column (api-key | oauth | not-configured)
cyberine auth logout openrouter  # remove a provider's keys

cyberine auth status now lists every registered provider with its auth method:

Provider auth status:
  Provider               Auth method        Status
  ---------------------- ------------------ --------------
  DeepSeek               api-key            live
  Anthropic (Claude)     not-configured     -
  GitHub Copilot         oauth              live
  ...