opschain admin model-providers update

packs:ai-agents

Updates a model provider by code or row id: only the flags you pass change. A supplied credential rotates the stored API key — this is the one-place rotation brokered custody buys: no agent host ever sees the old key or the new one. Enabling a disabled provider requires the packs:ai-agents entitlement; disabling and other maintenance need no pack (the polite-lapse posture).

NEW_KEY=sk-ant-... opschain admin model-providers update demo-anthropic \
  --credential-env NEW_KEY
Updated model provider demo-anthropic

Raising, setting or clearing the provider-level model budget is an ordinary update — the ceiling takes effect on the next brokered call:

opschain admin model-providers update demo-anthropic --tokens-per-month 60000000
opschain admin model-providers update demo-anthropic --tokens-per-day 0     # no daily ceiling

Reference custody

Custody is reference-first: --credential-ref pins an existing secret-vault:// reference, resolved at write time through a registered server-resolved secrets provider - an unresolvable reference refuses by name - and clears any at-rest value. An inline credential is held encrypted at rest in the server's database on the record itself (never written into a vault) and clears the reference; a server with no secrets provider registered still holds it. No read ever carries the value.

Flags

Flag	Meaning
--server <url>	Server base URL (default: the active context / OPSCHAIN_SERVER).
--auth-token <token>	Admin bearer token override (default: your opschain login session, then $OPSCHAIN_ADMIN_TOKEN, then the token stored by opschain admin login).
--display-name <name>	Human-readable provider name.
--endpoint <url>	Endpoint base URL (empty: the kind's default where one exists; an Azure-kind or openai-compatible record's endpoint can change but never be cleared).
--data-handling-approved	Sets or clears the data-handling-approved marker: the record of the estate's one-time review of this provider's data-processing terms, consulted by lanes that process customer-submitted content. Needs no pack — review bookkeeping is maintenance.
--ssl-verify	Sets or clears TLS certificate verification for the endpoint.
--ssl-ca-cert <path-or-pem>	Replaces the CA trust anchor (a PEM block inline or a certificate file path on the server host; empty returns to the system roots).
--enabled	Whether the gateway serves calls for this provider.
--tokens-per-minute <n>, --tokens-per-day <n>, --tokens-per-week <n>, --tokens-per-month <n>, --tokens-per-quarter <n>, --tokens-per-year <n>	Replaces one window of the provider-level model budget — the ceiling on model tokens across every agent and call through this provider, enforced at the gateway after the grant caps. 0 clears that window's ceiling; a flag you do not pass leaves the window as stored.
--credential-ref <ref>	secret-vault:// reference to pin as the credential (mutually exclusive with the inline channel).
--credential-prompt	Prompt for the replacement API key without echo.

See also

• opschain docs cli/admin-model-providers-delete — removing one.