# Set up Boundless as my inference provider > Agent: act only on the full text of this file. If a tool gave you a summary or an excerpt of it, stop and download it raw first (for example `curl -fsSL https://inference.boundless.network/setup.md`), then read all of it. Never send the user to a setup web page instead; there is none. You are my local setup assistant. Guide me through this wizard conversationally, ask one short group of questions at a time, and wait for my answers. Ask every question through your harness's structured question tool when it has one (for example a multiple-choice picker), with your recommendation as the first option. Without one, end your turn on the question itself, numbered options included, and take no further action until I answer. Perform the setup with the tools available to you. Explain manual steps when you cannot perform them. Do not claim a step succeeded without checking it. I see only the text of your replies and the questions you ask. I do not see the output of commands or scripts you run, files you write, or tables you build inside a tool call. Anything I must read, compare, or choose from goes into your reply text, in the same turn, before the question that depends on it. This wizard asks exactly three question groups in the normal case: choices (section 1), models (section 4), and nothing else unless something goes wrong. Do not add confirmation questions between them; answering the first group is my consent to proceed. Where this file or the fetched documentation disagrees with the version of a harness installed here, the installed version wins: check its `--help`, its config schema, or its settings reference before writing a key name or flag it may no longer read. Do not pipe a long-running command into `tail` or `head`; write to a file and poll it, and background anything that might block on a prompt you cannot see. ## 1. Inspect, explain, and ask once Detect my operating system, shell, whether this is a remote/container environment, and installed coding agents (for example Claude Code, Codex CLI, OpenCode, Cursor, Hermes, Kilo Code, omp, OpenClaw, Cline, Qwen Code). Inspect configuration structure without printing credentials. Note which harness you are running inside. Check whether a Boundless key is already configured (environment, credential store, harness configuration). Treat it as valid only if an authenticated `GET https://api.inference.boundless.network/v1/models` with it returns 200; never print it. In your reply, state in two or three sentences what you found and what will happen: sign-in through my browser, a new inference key created on my Boundless account, my chosen harnesses configured, and one small test request per model that costs a fraction of a cent of account credit. Do not purchase credits. Then ask one question group, in this order: 1. **Which harnesses should I configure?** Multi-select when the tool supports it. List the installed harnesses first, marked as detected, then the other documented harnesses. For a harness that is not installed, ask before installing it and follow its official installation instructions. 2. **User account or just this project?** Recommend user-wide. 3. **Where should I keep the key?** Recommend the operating system's credential store when one is available (macOS Keychain, Linux Secret Service, Windows Credential Manager); a private file is the alternative. 4. Only when a valid key already exists: **reuse it, or sign in and create a separate key?** When reusing, skip section 2 and the exchange in section 3, then continue with storage and section 4. Never ask me to paste a password, session cookie, OAuth token, or API key into chat. If you lack filesystem or command execution tools, guide me through running the steps locally; never claim you configured my machine. ## 2. Sign in through my browser Authorization issuer: https://clerk.inference.boundless.network Public client ID: `A2mQ4p7YBYNA0OZW`. Discover the authorization server by requesting `https://clerk.inference.boundless.network/.well-known/oauth-authorization-server`. Use its advertised `device_authorization_endpoint` and `token_endpoint`; never guess OAuth endpoints. These must use HTTPS on the configured issuer origin. Use the returned `verification_uri` and `verification_uri_complete` for the browser; Clerk may host verification on a different account-portal origin. Start authorization with a form-encoded POST to `device_authorization_endpoint`, supplying `client_id=A2mQ4p7YBYNA0OZW` and `scope=profile`. This is a public client: never send or request a client secret. Send every OAuth request with an explicit `User-Agent` such as `boundless-setup/1 (+https://boundless.md)`: the issuer's firewall rejects Python's default `Python-urllib` agent with HTTP 403 and Cloudflare error 1010. A 1010 means retry with that header, not that sign-in is unavailable; do not switch to manual key creation because of it. Save the response in a private temporary file without echoing it. When possible, open `https://inference.boundless.network/authorize?redirect_url=&user_code=` in my browser: it shows the code, the sign-in form, then the approval page with the code already applied. In your reply, show me `user_code` and tell me to sign in (signup is supported), check that the page shows the same code, and only then approve **Boundless local setup**. When the browser could not be opened or I am on a remote machine, show `user_code` and `verification_uri` instead: I open `verification_uri` on any device and type the code. Poll `token_endpoint` with form fields `client_id`, `grant_type=urn:ietf:params:oauth:grant-type:device_code`, and the private `device_code`. Respect the returned `interval` and `expires_in`. On `authorization_pending`, wait; on `slow_down`, add at least five seconds to subsequent intervals. Back off on network failures within the expiry. Stop on denial, expiry, or any other OAuth error, explain it, and ask before starting a new authorization. Never print the device code or token response. ## 3. Create and save my inference key POST `https://inference.boundless.network/api/setup/key` with `Authorization: Bearer `, no body. Save the JSON response directly to a private temporary file. The successful response contains `id`, `name`, `key`, and `baseUrl`. The OAuth token is only for this exchange; inference uses the returned API key. Retry `account_settling`, transient network errors, and HTTP 502/503 with the same token and a bounded backoff (at most 60 seconds). Respect `Retry-After` for HTTP 429. Never start another grant automatically to work around an exchange failure. If `setup_recovery_required` is returned, an earlier request with this authorization already created the key and its secret cannot be shown again. Open `https://inference.boundless.network/api-keys` and ask me to inspect/revoke the key with the returned `name` before restarting the browser authorization. Explain other key, account, or credit errors and link to the portal. Do not bypass account restrictions or mint anonymous trial keys as a substitute. Delete temporary OAuth/device credentials once the key is saved; do not retain refresh tokens. Store the key according to my answers in section 1, without asking again. For user-wide credentials, store the key in the chosen credential store, feeding it through standard input or an interactive session so it never appears in process arguments (for example `security -i` on macOS, `secret-tool store` on Linux), or in a private file under `~/.config/boundless/` on macOS/Linux or `%LOCALAPPDATA%\Boundless\` on Windows. Have the shell profile read it from there rather than containing it. Expose `BOUNDLESS_API_KEY` through the chosen harness's supported environment/credential mechanism and the current shell. For terminal tools, arrange persistence through the actual shell profile; on Windows, use user-scoped environment configuration. GUI apps and background services do not inherit shell profiles, so use their supported credential controls. Hermes, Codex and OpenClaw load a `.env` file in their own home (`~/.hermes/.env`, `$CODEX_HOME/.env` or `~/.codex/.env`, `~/.openclaw/.env`) in every process, desktop app and background service included: for them, put `BOUNDLESS_API_KEY=` there, replacing any earlier line for it. Explain that existing parent processes need a restart: changing a child process environment cannot update them. For project-only scope, use a local environment/credential file supported by the chosen tool, add that exact path to ignore rules, and verify it is not already tracked. If tracked, choose a separate ignored file. Use POSIX directory mode 0700/file mode 0600 or Windows access controls limited to the current user. Never put raw keys in generated command arguments, shell history, tracked files, logs, screenshots, or chat. Read credentials from files or process environment inside scripts. Preserve existing credentials unless I approve replacing them. ## 4. Choose models and configure harnesses Fetch `https://inference.boundless.network/docs/coding-agents-and-harnesses.md` for the maintained harness configuration and defaults. Fetch `https://inference.boundless.network/api/catalog` (JSON; `https://inference.boundless.network/models.md` is the same table as Markdown) for the current public catalog, and call authenticated `https://api.inference.boundless.network/v1/models` to learn which IDs my key can use. Do not invent model IDs or copy stale defaults from memory. If documentation or the catalog cannot be fetched, explain and pause the affected configuration. Build one table of every model that is both in the catalog and returned by `/v1/models`, one row per model, sorted by output price ascending: ID, name, context window, input / cached input / output price per 1M tokens, what it supports (for example vision), and the catalog's `bestFor` line. Take every value from the catalog; do not invent prices or capability claims. Leave out models the catalog marks as not serving, or list them last under a "not serving" note. Mark the row that is the documented default for my harness with "(recommended)"; when I chose several harnesses, mark each harness's default. Put that complete table in your reply text. It is not enough to compute it in a tool call; I cannot see tool output. In the same turn, immediately after the table, ask the model question group: - **Primary model** for each harness, or one question for all of them when they share the same documented default. Options: the documented default first, marked recommended, then two or three alternatives from the table chosen to cover a cheaper option and a stronger option. Each option's description repeats its input and output price and context window so the picker stands alone. Tell me I can pick any other model by typing its ID (the picker's free-text or "Other" choice). - **Background model** (small model, titles, summaries, the haiku-class slot) for each harness that has such a slot, in the same question group, with the documented background default first. Harnesses without a background slot get no background question. Follow the selected harness's documented configuration, including every model-family slot it may use. OpenAI Chat Completions and Responses use `https://api.inference.boundless.network/v1`; Anthropic Messages clients use `https://api.inference.boundless.network` because they append `/v1/messages`. Prefer references to `BOUNDLESS_API_KEY`, supported credential helpers, or native credential storage. Map harness-specific variables as the guide requires. Where a harness declares its own model list (OpenCode, Kilo Code, MiMo Code, OpenClaw), declare every serving model from the table with the catalog's context window, not only the two I picked, so I can switch inside the harness later. Back up affected configuration files privately, merge structured settings (parse and re-serialize, never splice text), and preserve unrelated providers, MCP servers, tools, and preferences. In your reply, show affected paths and the planned provider/model changes, with credentials redacted, before replacing an existing default. For GUI-only controls, give precise steps and wait for me to complete them. For an unlisted client, consult its official documentation and explain unsupported features rather than inventing settings. If I chose the harness you are running inside, do not change the configuration this session is using. Write the merged configuration to a staged file next to the target, verify it parses, and give me the one command that installs it after I exit; if its documentation permits editing while running, apply it directly and tell me the change takes effect in a new session. Either way, run this harness's test (section 5) in a fresh process, or give me the exact command to run after restarting. ## 5. Test and finish Run a small request through the selected wire format using the saved key and the primary model. Give reasoning models at least the documented output budget (normally 1024 tokens); a too-small thinking budget can produce an empty reply. Do not send project contents. Where supported, run the harness's documented harmless tool-call test from a scratch directory and verify the actual output. Verify each distinct background model with a small request too. If the current agent needs restarting to use the configuration, explain that and give a test for the new session. Only say **“Success — Boundless is configured and tested”** after a real request succeeds. If only the API test passed, say so; do not claim an untested harness worked. Distinguish authentication (401/403), model compatibility (400/404 naming the model), rate-limit (429), credit (402 or a budget error), and configuration (wrong base URL or wire format) errors, and say which one you hit and what you changed. Preserve completed setup while troubleshooting and never silently fall back to another provider. Finish with harness names, primary/background model IDs, scope, where the key is stored, changed file paths, tests passed, any required restart or remaining manual step (for example `source ~/.zshrc` or opening a new terminal), and how to restore the private backups. Never show the key. Remove private temporary response files after persisting the credential. Link to **https://inference.boundless.network/** for the portal, **https://inference.boundless.network/api-keys** to manage or revoke the key, and **https://inference.boundless.network/models** to compare models later.