Cmd+, / Ctrl+,).
Quick Setup
- Open Settings (
Cmd+,/Ctrl+,) - Navigate to Providers
- Expand any provider and enter your API key
- Start using models from that provider
Supported Providers
For catalog suggestions and manual model IDs, see Add custom models.
Environment Variables
Providers also read from environment variables as fallback:Advanced: Manual Configuration
For advanced options not exposed in the UI, edit~/.xum/providers.jsonc directly:
OpenAI wire format
The built-inopenai provider supports two wire formats:
OpenAI documents that GPT-6 Astra only supports tool calling through the Responses API, so keep
responses when using that model.
Set the format in Settings → Providers → OpenAI → Wire format, or in
~/.xum/providers.jsonc:
openai baseUrl without a path gains /v1 automatically;
add a trailing slash to keep requests at the origin root.
For llama.cpp, vLLM, LM Studio, and multiple local endpoints, prefer named custom
providerType: "openai-compatible" providers instead of changing the built-in OpenAI provider.
Cyber mode (OpenAI Daybreak)
OpenAI’s Daybreak access programs provide approved access for cybersecurity work; a Responses API request selects one withaccess_programs.cyber. The request value selects behavior within your approved access and does
not grant access. Turn on
Settings → Providers → OpenAI → Enable cyber model (off by default) to add a Cyber option
to the reasoning selector next to the model picker, or run “Toggle Cyber Mode” from the Command
Palette. Cyber and Pro are mutually exclusive.
Cyber appears only for models with a documented Daybreak value. GPT-6.1 Sol and GPT-6 Astra send
daybreak_blue. OpenAI requires Daybreak Red approval for reduced refusals on these models, but
they still take daybreak_blue. Cyber works only with the built-in OpenAI provider’s API key on
the responses wire format. A custom base URL on the built-in provider also receives the field.
Gateways, custom providers, Codex OAuth, and Chat Completions use standard safeguards.
If OpenAI rejects the program, Xum shows OpenAI’s message and does not retry:
Custom providers
Custom providers let you keep the built-inopenai and anthropic providers for their official
APIs while adding named local endpoints, remote gateways, or proxies. Each custom provider selects
the API format that its endpoint accepts.
Add each endpoint as a top-level provider in ~/.xum/providers.jsonc:
openai-compatible, so existing custom
provider setups continue to use Chat Completions.
Base URL normalization depends on the selected format:
openai-compatibleandopenai-responses: an origin-only URL such ashttp://localhost:8080gains/v1. Explicit paths remain unchanged. A trailing slash, such ashttp://localhost:8080/, keeps requests at the origin root.anthropic-messages: trailing slashes are removed and/v1is appended unless the URL already ends in/v1. For example,https://gateway.example/anthropicbecomeshttps://gateway.example/anthropic/v1.
apiKey or apiKeyFile instead of query parameters.
To configure a single OpenAI-shaped gateway through the built-in openai provider instead, see
OpenAI wire format.
Provider IDs must use lowercase letters, digits, _, and -, and must start with a letter or digit. They must not collide with
built-in provider names, and cannot contain ., :, /, or whitespace. Good examples are
local-vllm, llama-cpp, and lm-studio.
llama.cpp
vLLM
LM Studio
baseUrlis resolved from the Xum backend process. In desktop mode, this is your local machine. In server mode, the endpoint must be reachable from the server.- Most compatible servers require the
/v1suffix in the URL. Use the normalization rules above when a gateway mounts its API under another path. - Keep the official providers for provider-specific account features such as Codex OAuth and OpenAI service tiers. Custom providers select the request format but do not inherit those features.
- Custom providers are direct-only and do not participate in gateway routing.
- You no longer need to set a fake
apiKeyto point Xum at a keyless local server.
Coder (Login with Coder)
The Coder provider routes requests through a Coder deployment’s AI Gateway (/api/v2/aibridge), so usage is authenticated, governed, and audited by the
deployment instead of a personal API key.
Deployment prerequisites (admin-side):
- The OAuth2 provider experiment: start
coderdwith--experiments=oauth2(orCODER_EXPERIMENTS=oauth2) - AI Gateway entitlement and
--aibridge-enabled, with at least one provider configured
- Open Settings → Providers → Coder
- Set the Deployment URL (e.g.
https://coder.example.com) - Click Login with Coder and approve the request in your browser
~/.xum/providers.jsonc. Tokens refresh automatically; Disconnect revokes and clears
them.
After login, Xum discovers the deployment’s configured AI Gateway providers (instances such as
anthropic or claude-aws-us-east-2) but does not load their model catalogs, which can hold
thousands of IDs. Each provider’s type (anthropic, openai, google, bedrock, openai-compat, …)
decides the wire protocol Xum speaks to its gateway route. Use Refresh providers under
Model routing (or run the “Settings: Refresh Coder providers” command) to re-discover
providers without a re-login. A loaded catalog then drops the models of providers that were
removed or changed type.
Press Load model catalog (or run the “Settings: Load Coder model catalog” command) to fetch
every provider’s catalog. Catalog models are identified as coder:<provider>/<model> (e.g.
coder:anthropic/<model>, coder:my-openai/<model>), and the button then reads Refresh model
catalog (N) with the number of loaded IDs. If any provider’s catalog request fails (a provider
that serves no catalog is skipped), the first load does not complete and the catalog stays
unloaded until a retry succeeds; once loaded, a failing provider keeps its previous entries.
Catalog loading never adds models to your configured list. Under Settings →
Models, select the Coder provider, then use the Model ID field to search catalog
suggestions or type a custom model ID; typing works even when the catalog is not loaded.
Picking a suggestion adds it immediately; press Add or Enter to add a typed ID. Nothing
appears in the model picker until you add it. Added models survive catalog refreshes, re-logins
and Disconnect. Removing a model only removes it from your list; use the Route column to
steer a model away from Coder. Once a catalog is loaded, built-in models route through Coder only
when the catalog lists them; /model coder:<provider>/<model> still selects a catalog model for
the current workspace without adding it.
Model routing
Model routing maps each native provider (Anthropic, OpenAI, Google) to the deployment’s AI Gateway provider that should serve its models. The model picker keeps showing native models such asanthropic:<model>; when route priority picks Coder for one, Xum sends it to the mapped
provider instead (coder:claude-aws-us-east-2/<model> on the wire).
- Only providers of the same type are offered: an Anthropic mapping must point at an anthropic-type provider, and so on.
- Default keeps the built-in behavior: Anthropic and OpenAI models use the gateway provider
named
anthropicoropenai; Google models route through Coder only when mapped. - A mapping to a provider that is no longer known (or has a different type) shows as “(not found)”, and that native provider does not route through Coder until you pick another one.
- Mapping does not change whether Coder is used: route priority and per-model Route
overrides still decide that. Explicit
coder:<provider>/<model>selections always address the named provider literally. - The Coder card’s Routes to line lists the native providers that currently route through Coder, including a mapped Google and excluding a “(not found)” mapping.
- The model picker does not show the route: Settings → Models shows it per model, and replies from native models sent through Coder are marked “via Coder” in the transcript.
- The deployment’s AI Gateway logs attribute Gemini traffic to
openai, because Xum speaks the OpenAI-compatible protocol to google-type providers. - Mappings are stored as
canonicalRoutesin thecodersection of~/.xum/providers.jsonc. Xum also keeps its own bookkeeping keys there (discoveredProviders,discoveredModels,staleDiscoveredModels,discoveredModelsUnlisted,coderCatalogGeneration); do not edit them by hand.
~/.xum/providers.jsonc:
/auth/coder/callback) so the redirect reaches the server directly. A remote server must
be reachable over HTTPS for Coder to accept that callback URL.
Bedrock Authentication
Bedrock supports multiple authentication methods (tried in order):- Bearer Token - Single API key via
bearerTokenconfig orAWS_BEARER_TOKEN_BEDROCKenv var - Explicit Credentials -
accessKeyId+secretAccessKeyin config - AWS Credential Chain - Automatic resolution from environment,
~/.aws/credentials, SSO, EC2/ECS roles
aws sso login), Xum uses those credentials automatically.
Anthropic Fast mode
Claude Opus 5.5, Opus 5, and Opus 4.8 support Anthropic’s Fast mode research preview: up to 2.5× faster output at 2× token pricing. Toggle it from the thinking selector’s Fast mode row, the command palette (Toggle Fast Mode), or its keyboard shortcut. Xum stores the preference as"speed": "fast" under anthropic in providers.jsonc.
Fast mode is only sent on the direct Anthropic API with an account that has Fast mode access. It is hidden for gateway routes (Xum Gateway, OpenRouter, Bedrock, Coder), custom Anthropic-compatible providers, a non-api.anthropic.com base URL, and when Anthropic beta features are disabled for ZDR. Costs are priced from the speed Anthropic reports for each response.
OpenRouter Provider Routing
Control which infrastructure providers handle your requests:order: Priority list of providers (e.g.,["Cerebras", "Fireworks"])allow_fallbacks: Whether to try other providers if preferred ones are unavailableonly/ignore: Restrict or exclude specific providersdata_collection:"allow"or"deny"for training data policies
xAI Search Orchestration
Grok models support live web search. Xum enables this by default withmode: "auto". Customize via searchParameters for regional focus, time filters, or to disable search.
Model Parameter Overrides
Set per-model defaults for parameters like temperature, token limits, and sampling by adding amodelParameters section under any provider:
Supported parameters
Any unrecognized key is passed through as a provider-specific option (for example, OpenRouter routing hints).
Resolution order
When multiple entries could match, the first match wins (no merging across tiers):- Effective model ID - a dated snapshot like
claude-sonnet-4-5-20250929 - Canonical model ID - the model you selected, e.g.
claude-sonnet-4-5 - Wildcard
"*"- catch-all for that provider
"claude-sonnet-4-5" and "*" with different temperatures,
requesting claude-sonnet-4-5 uses the specific entry - the wildcard is not merged in.
Priority with other settings
Formax_output_tokens specifically, the priority chain is:
- Explicit per-message override (from thinking level or UI)
modelParametersconfig value- Model’s built-in default