SDK Configuration

AI provider credentials

Every agent runner accepts an optional authConfig object with your AI provider credentials. There are two ways to build it.

From Apex configuration

config.get() reads ~/.pensar/config.json, the same file the TUI and pensar CLI write. For any provider key missing from the file it falls back to an environment variable. buildAuthConfig() converts the result into the authConfig shape agents expect:

import { buildAuthConfig } from "@pensar/apex/core/ai";
import { config } from "@pensar/apex/core/config";
const authConfig = buildAuthConfig(await config.get());

This is the recommended approach. It picks up keys saved through /providers, a Pensar Console login from pensar login, and any of these environment variables:

Explicit credentials

To avoid reading or writing ~/.pensar/config.json (for example, in a container), pass credentials directly:

const authConfig = {
  anthropicAPIKey: process.env.ANTHROPIC_API_KEY,
};

Models

Agents take a model string. It uses the same model IDs as the CLI’s --model flag:

The model you choose must belong to a provider whose credentials are in authConfig. For the full list, run /models in the TUI or see Supported AI Providers.

Reasoning

Agents accept a reasoning setting that controls extended thinking for models that support it:

Pensar Console authentication

The Console API functions (listIssues, dispatchPentest, listApps, …) don’t take credentials as arguments. They read them from Apex configuration on every call: the session saved by pensar login first (refreshed automatically when it expires), then PENSAR_API_KEY. After pensar login, requests are scoped to the workspace you selected.

Set these environment variables to point the SDK at a different Pensar deployment: