Skip to content
pi-mistral-native

Credential chain

The two sources of the API key, checked in this order:

  1. Stored credential — a mistral-native API-key entry in ~/.pi/agent/auth.json, written by /login mistral-native. A !command entry (resolving the key from a secret manager) is resolved by pi itself.
  2. Environment variable — MISTRAL_API_KEY, the zero-configuration default.

A stored credential whose key is empty (a hand-edited auth.json) carries no usable key material and falls through to the environment variable.

Credentials are scoped by provider id: an existing mistral entry in auth.json belongs to a different provider and does not apply to mistral-native — run /login mistral-native to store a key for this provider.

The key goes only to the outbound Authorization: Bearer header. It is never logged, never embedded in error messages, and never written into tool results or the config file.

See Set up your API key · Keep secrets out of the config file