API Key Lifecycle

Where keys live, how they reach the provider, and how to rotate them

1 — Enter Settings → API Keys User pastes key into field masked display (••••) 2 — POST Gateway API POST /api/hermes-proxy/config key routed to agent on save 3 — Store ~/.hermes/.env plain text key=value pairs chmod 600 recommended writes 4 — Reference ~/.hermes/config.yaml key_env: CUSTOM_API_KEY (name, not the value) name ref 5 — Agent startup (reads both files) Hermes Agent loads .env into env vars reads config.yaml providers block reads on startup Provider router looks up key_env name resolves value from env Attach to request Authorization: Bearer <value> or api-key header Per-provider key names Anthropic ANTHROPIC_API_KEY OpenRouter OPENROUTER_API_KEY Z.AI / GLM GLM_API_KEY Kimi / Moonshot KIMI_API_KEY MiniMax MINIMAX_API_KEY Custom endpoint CUSTOM_API_KEY Key rotation Edit key in Settings or edit ~/.hermes/.env directly Save new value written to .env Restart agent re-reads .env from disk Security Keys stored as plain text in ~/.hermes/.env — run: chmod 600 ~/.hermes/.env — never commit this file to version control Legend Switch UI ~/.hermes/ storage Hermes Agent Key rotation

Where keys live

  • • All keys: ~/.hermes/.env as plain text
  • • config.yaml references keys by name via key_env
  • • Agent reads .env at startup — restart required after changes
  • • UI shows masked (••••) display via gateway API

How keys reach providers

  • • Provider router looks up key_env name in env
  • • Value attached as Authorization: Bearer header
  • • Per-provider names: ANTHROPIC_API_KEY, OPENROUTER_API_KEY, etc.
  • • Custom endpoint: always CUSTOM_API_KEY

Rotation and removal

  • • Rotation: edit field in Settings → Save → restart agent
  • • Or edit ~/.hermes/.env directly and restart
  • • Removal: delete line from .env manually → restart agent
  • • Ollama and local providers: no key needed

Hermes Switch UI • API key lifecycle • Settings → ~/.hermes/.env → key_env → provider header