model-providers git:20261029.727fb3cA

Immutable. This exact content never changes and is served at /api/v1/blob/f8a0c00286c2dbe4.

---
name: model-providers
description: "Choose models and configure access via Vertex AI, Gemini API, or OpenRouter."
license: MIT
metadata:
  kind: collection
  author: Médéric HURIER (Fmind)
  source: github.com/fmind/dot/tree/main/skills/model-providers
  created: "2026-09-16"
  updated: "2026-10-29"
---

# Model Providers

Configure provider authentication, endpoints, and model selection. Default new integrations to **GCP Agent Platform with ADC**, `global`, the latest GA model of the chosen tier, and high thinking. The personal project is `ai-studio-fmind`; explicit project/customer settings take precedence. Preserve OpenCode's OpenRouter default. Use API keys only when explicitly requested or as a last resort after reporting why ADC cannot work; never retry automatically with a key or switch to AI Studio after an error.

## Workflow

1. **Never let a key pick the provider**: resolve the requested provider before inspecting credentials. An available key is not a reason to switch providers. Use the selected guide only; [gcloud](../gcloud/SKILL.md) owns Cloud identity/IAM and [agent-harnesses](../agent-harnesses/SKILL.md) owns coding-host settings.
1. **Choose the tier, then the latest model**: default to the workhorse tier (the latest GA Flash) for agents, tool calls, extraction, and high-volume or latency-sensitive work. Escalate to the frontier tier (Gemini 4 Argon where the project has access, otherwise the latest Pro) for complex long-horizon reasoning, coding, or analysis where quality outweighs cost and latency. Resolve the exact ID from the provider's current model list, never from memory, and confirm it with the read-only probe.
1. **Pin the provider and scope keys**: make the provider explicit in application configuration so ambient Google API keys or SDK backend flags cannot silently select another service. Supply keys only to the process that needs them, through a secret manager or `dot secret run NAME -- COMMAND`; use native credential stores where supported. Never place keys in code or generated configuration.
1. **Probe read-only; never silently fall back**: validate configuration and use a read-only model/auth probe first. Run inference only within the authorized usage scope, with a bounded output and timeout. Report authentication, model access, and successful inference separately; do not silently fall back to another provider or billing project after an error.

## Task guides

<!-- guides:start -->

- [gcp-agent-platform](references/gcp-agent-platform.md): GCP Agent Platform model access with ADC and global location.
- [gemini-api](references/gemini-api.md): Gemini Developer API access with an explicitly requested API key backend.
- [openrouter](references/openrouter.md): OpenRouter model routing, API key authentication, and OpenAI-compatible requests.

<!-- guides:end -->