> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corbits.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Corbits Code

> Where Corbits Code keeps its settings and provider credentials, and how to choose a provider and model at launch.

First run writes your provider for you, so most people never open these files. When you do want to look, this is where things live.

<Note>
  This page describes **Corbits Code**, the app. It does not describe credentials or grants held by the control plane, and it does not speak for the shared agent runtime.
</Note>

<Info>
  Global settings live in `~/.corbits/settings.json` (providers and credentials). A per-repo `.corbits/settings.json` chooses the provider, model, and reasoning effort, and may also register MCP servers and set environment variables for the shell the agent runs commands in. An MCP server entry may carry its own `env` map, including a token needed by that server. Outside those entries, Corbits Code ignores credential-like top-level keys and reports a diagnostic. Codex tokens live in `~/.corbits/codex-auth.json` and xAI tokens live in `~/.corbits/xai-auth.json`; neither is ever written to `settings.json`. ([`MCP entry schema`](https://github.com/corbitsdev/corbits-code/blob/main/src/config/settings.ts#L594-L603); [`local credential-key guard`](https://github.com/corbitsdev/corbits-code/blob/main/src/config/settings.ts#L1115-L1126))
</Info>

Select at launch with `--provider` and `--model`, or point at an alternate definitions file with `--config`.

Most providers are reached over the OpenAI-compatible protocol, and Corbits Code also selects the runtime's native Anthropic Messages path when the configured provider declares it. ([`inference routing`](https://github.com/corbitsdev/corbits-code/blob/main/src/config/inference-sources.ts#L100-L109); [`provider catalog`](https://github.com/corbitsdev/corbits-code/blob/main/packages/first-class-providers/src/providers.ts#L97-L104))

Provider credentials are read only from the settings files and the OAuth token stores. There is no environment-variable override for them and `.env` files are not loaded, so a stale or exported key can never silently shadow the configured provider. Both `settings.json` files sit on the [secret-guard denylist](/platform/corbits-code/steering-and-safety), so the agent cannot read its own API-key credentials through a file tool. A shell command that names one stops for an operator prompt instead. The OAuth token files are not on that denylist. ([`settings schema`](https://github.com/corbitsdev/corbits-code/blob/main/src/config/settings.ts); [`secret path guard`](https://github.com/corbitsdev/corbits-code/blob/main/src/plugins/secret-guard-plugin.ts))

***

## Support

<Card title="Help Center" icon="circle-question" color="#e98428" href="https://t.me/+JnlJ64eDGuNkM2Nh">
  Join hundreds of developers building with Corbits and speak with the team directly.
</Card>