Providers

Posit Assistant works with a range of model providers, though the exact set and how you set them up varies by platform.

Supported Providers

The following providers are available on RStudio and the Terminal (TUI):

Provider	Authentication
Posit AI Pass	Sign in (OAuth)
Anthropic	API key
OpenAI	API key
Google Gemini	API key
OpenRouter	API key
DeepSeek	API key
Amazon Bedrock	AWS credentials
Google Vertex AI (Experimental)	Google Cloud credentials
Microsoft Foundry	API key or Microsoft Entra ID
Snowflake Cortex	connections.toml or API key
Databricks (Experimental)	Workspace URL + token or OAuth
OpenAI Compatible	Base URL (API key optional)
Ollama (Local)	No credentials
LM Studio (Local)	No credentials

The following additional providers are available in Positron only:

Provider	Authentication
GitHub Copilot Preview	Sign in (OAuth)

Configuring Providers

How you configure providers depends on your platform:

• RStudio — Providers can be configured through the assistant settings UI.
• Terminal (TUI) — Press Ctrl+O to open the provider configuration screen, where you can sign in or enter credentials for supported providers.

For most API-key providers (Anthropic, OpenAI, Gemini, DeepSeek, OpenRouter, etc.), you just need an API key from the provider’s website. Provider Setup below covers the providers that need more than that.

Anything the settings UI doesn’t cover is set in the global provider config file, providers.json — proxy base URLs and custom headers, which models appear in the picker, disabling providers, declaring your own custom providers, and the connection settings a few providers need. That page also links to the full settings reference, which lists every key the file accepts. The setup notes below name the field to set and link into it.

Provider Setup

Posit AI Pass

Posit AI Pass is a managed service from Posit that gives you access to frontier LLMs through a single account. It’s the easiest way to get started — sign in once with no API keys to manage. See the Posit AI Pass documentation for account setup, available models, and billing.

Amazon Bedrock

Amazon Bedrock uses AWS credentials rather than an API key. Configure access using the AWS CLI:

1. Install the AWS CLI and run aws configure to set up your credentials.
2. Ensure your IAM user or role has permissions to invoke Bedrock models (bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream) and to discover them (bedrock:ListFoundationModels and bedrock:ListInferenceProfiles). Without bedrock:ListInferenceProfiles, model listing still works in us-, eu-, and ap- regions via a legacy fallback, but other regions (such as ca-central-1 or me-central-1) require it and will show no models.

OpenAI gpt-oss and GPT-5.x models use Bedrock Mantle. The simplest setup is AWS’s AmazonBedrockMantleInferenceAccess managed policy. A custom least-privilege policy should include AWS’s documented Mantle inference permissions: bedrock-mantle:CreateInference, bedrock-mantle:GetProject, bedrock-mantle:ListProjects, and bedrock-mantle:ListTagsForResource, plus bedrock-mantle:ListModels for model discovery. On a model’s first use in an account it also needs aws-marketplace:Subscribe and aws-marketplace:ViewSubscriptions (scoped with aws:CalledViaLast = bedrock-mantle.amazonaws.com), unless an administrator has already enabled the model. Those Marketplace permissions are no longer needed after subscription; see AWS’s model access guide.

Set the region and profile with aws.region and aws.profile in providers.json, or with the AWS_REGION and AWS_PROFILE environment variables. If you set neither, Bedrock falls back to us-east-1.

If you use AWS SSO and your session expires, Posit Assistant shows a notification. In the graphical desktop and web apps (Standalone, Desktop, Canvas, Connect, and RStudio) it carries a Sign in again button — one click opens the provider configuration and starts the refresh. In the Positron extension and the TUI, the notification instead directs you to run aws sso login, then click Refresh Models. The provider row shows the same Sign in again button. Either way, your credentials are refreshed in place — silently when a refresh token is cached, otherwise via a browser sign-in that shares the AWS CLI’s SSO cache (so aws sso login and Sign in again are interchangeable). When the browser runs on the same machine as Posit Assistant, sign-in uses the same PKCE flow as the AWS CLI: the browser rides your existing SSO session and redirects straight back, with no code to copy. The first sign-in with a new client registration asks you to allow access once; later sign-ins skip that page (the registration is shared with the AWS CLI’s cache, so consent given to aws sso login carries over). On remote or headless hosts (and whenever the local listener can’t start) it falls back to the device-code flow, which shows a code you can enter from any device’s browser. If no refresh can be attempted, Posit Assistant falls back to the configuration form.

Bedrock support is experimental in both AWS GovCloud regions: us-gov-west-1 and us-gov-east-1. Standard endpoints are used by default. To require AWS FIPS endpoints, set AWS_USE_FIPS_ENDPOINT=true, or set use_fips_endpoint = true in the selected AWS profile in your shared AWS config file. The environment variable takes precedence over the profile setting, including an explicit value of false. use_fips_endpoint is an AWS shared-config setting, not a providers.json field.

Mantle availability is model- and region-specific, so changing regions can legitimately change which gpt-oss and GPT-5.x models appear in the model picker.

AWS does not publish FIPS endpoints for Mantle. When FIPS is enabled, Posit Assistant skips Mantle discovery and does not offer or invoke Mantle models; other Bedrock models use the FIPS control-plane and runtime endpoints.

For Mantle Responses models, Posit Assistant sends store: false. This disables retrievable Responses storage, but it does not guarantee zero retention: AWS account/project retention policy is separate and should be configured to match your organization’s data-handling requirements.

Google Vertex AI

Google Vertex AI uses Google Cloud Application Default Credentials. Install the Google Cloud CLI, then authenticate:

gcloud auth application-default login

When these credentials expire, Posit Assistant shows a notification with a Sign in again button — one click opens the provider configuration and re-runs the login for you (the Google Cloud CLI opens its own browser window, so this requires a browser colocated with the host). The provider row shows the same Sign in again button. If the CLI isn’t installed or the host is remote or headless, Posit Assistant falls back to the configuration form.

Set your project and location with googleCloud.project and googleCloud.location in providers.json. location defaults to us-central1 if you leave it out.

Microsoft Foundry

Microsoft Foundry supports two authentication methods:

• API key (default). Enter the key for your Foundry resource along with its base URL.
• Microsoft Entra ID (experimental). Use ambient Azure credentials instead of an API key, for organizations that disable API-key authentication on their Foundry deployments. Authenticate with the Azure CLI (az login); managed identity, workload identity, and environment service principals also work through Azure’s DefaultAzureCredential chain. See Microsoft’s keyless authentication guidance for setup.

Entra mode is selected per deployment in the provider’s configuration form, or with azure.authMode in providers.json. The token scope defaults to https://cognitiveservices.azure.com/.default; set azure.scope (e.g. to https://ai.azure.com/.default) or azure.tenantId if your deployment requires it. No secret is stored in Entra mode — tokens are acquired and refreshed by the Azure credential chain.

Snowflake Cortex

Posit Assistant can authenticate to Snowflake Cortex two ways:

• From a connections.toml connection (recommended). If you already have a Snowflake connections.toml (used by the Snowflake CLI and Python connector), the configuration screen discovers its connections and lets you pick one. The credential is then acquired automatically based on the connection’s authenticator — external-browser single sign-on (EXTERNALBROWSER), key-pair JWT (SNOWFLAKE_JWT), a programmatic access token, or OAuth. The account host is derived from the connection’s account/host/region, so no base URL is needed.
• With a token and base URL. Alternatively, enter a token directly along with a base URL pointing to your account’s Cortex endpoint.

connections.toml is discovered from the standard locations ($SNOWFLAKE_HOME, ~/.snowflake, or the per-platform default directory). To point at a specific directory or pick a named connection, set snowflake.home and snowflake.connectionName in providers.json.

OpenAI Compatible (Custom Provider)

Connect to any endpoint that implements the OpenAI chat completions API. A base URL is required; an API key is optional (for unauthenticated local servers).

This is useful for arbitrary Custom Providers including self-hosted models, alternative API providers, or any service that exposes an OpenAI-compatible interface. Set the URL with baseUrl in providers.json.

Ollama

Ollama runs models locally on your machine. Install Ollama, pull a model, and you’re ready to go:

ollama pull llama3.2

No API key or credentials are needed. Posit Assistant talks to Ollama at http://localhost:11434 by default; if it’s running elsewhere, point at it with the OLLAMA_ENDPOINT environment variable or endpoint in providers.json.

LM Studio

LM Studio provides a local model server with a graphical interface. Install LM Studio, download a model, and start the local server. No API key or credentials are needed. Posit Assistant talks to LM Studio at http://localhost:1234/v1 by default; if it’s running elsewhere, point at it with the LMSTUDIO_ENDPOINT environment variable or endpoint in providers.json.

Databricks

Posit Assistant can discover and use models served by a Databricks workspace (Model Serving foundation models, external models, and custom serving endpoints). Every authentication method requires the workspace URL, such as https://dbc-example.cloud.databricks.com.

On RStudio and the Terminal (TUI), authenticate with a personal access token or service-principal OAuth. See the Databricks reference for setup, environment variables, and model availability details. The workspace host also goes in providers.json, as databricks.host.

Environment Variables

Provider credentials can also be set via environment variables. Environment variables take precedence over file-based configuration.

Environment variables must be set before the host environment (RStudio) starts, so for day-to-day IDE use the settings UI or providers.json reference is usually more practical. Environment variables are most useful for the TUI, CI/CD pipelines, and containerized deployments.

Variable	Description
ANTHROPIC_API_KEY	API key for the Anthropic provider
ANTHROPIC_BASE_URL	Custom base URL for the Anthropic provider
OPENAI_API_KEY	API key for the OpenAI provider
OPENAI_BASE_URL	Custom base URL for the OpenAI provider
GEMINI_API_KEY	API key for the Gemini provider
GEMINI_BASE_URL	Custom base URL for the Gemini provider
OPENAI_COMPATIBLE_API_KEY	API key for the OpenAI Compatible provider
OPENAI_COMPATIBLE_BASE_URL	Custom base URL for the OpenAI Compatible provider
MS_FOUNDRY_API_KEY	API key for the Microsoft Foundry provider
MS_FOUNDRY_BASE_URL	Custom base URL for the Microsoft Foundry provider
MS_FOUNDRY_AUTH_MODE	Foundry authentication mode: apikey (default) or entra
MS_FOUNDRY_ENTRA_SCOPE	Entra token scope for Foundry (default https://cognitiveservices.azure.com/.default)
MS_FOUNDRY_TENANT_ID	Azure tenant ID for Foundry Entra authentication
OPENROUTER_API_KEY	API key for the OpenRouter provider
DEEPSEEK_API_KEY	API key for the DeepSeek provider
DEEPSEEK_BASE_URL	Custom base URL for the DeepSeek provider
SNOWFLAKE_TOKEN	API token for Snowflake Cortex
SNOWFLAKE_BASE_URL	Custom base URL for the Snowflake Cortex provider
DATABRICKS_HOST	Workspace URL for the Databricks provider
DATABRICKS_TOKEN	Personal access token for the Databricks provider
DATABRICKS_CLIENT_ID	Service-principal OAuth client ID for Databricks
DATABRICKS_CLIENT_SECRET	Service-principal OAuth client secret for Databricks
AWS_REGION	AWS region for the Bedrock provider
AWS_PROFILE	AWS profile for the Bedrock provider
AWS_USE_FIPS_ENDPOINT	Use AWS FIPS endpoints for Bedrock; equivalent to use_fips_endpoint in the selected AWS shared-config profile
AWS_ACCESS_KEY_ID	AWS access key ID for the Bedrock provider
AWS_SECRET_ACCESS_KEY	AWS secret access key for the Bedrock provider
AWS_SESSION_TOKEN	AWS session token for the Bedrock provider
GOOGLE_CLOUD_PROJECT	Google Cloud project for the Vertex AI provider
GOOGLE_CLOUD_LOCATION	Google Cloud location for the Vertex AI provider
POSITAI_BASE_URL	Custom base URL for the Posit AI Pass provider
OLLAMA_ENDPOINT	Endpoint URL for Ollama
LMSTUDIO_ENDPOINT	Endpoint URL for LM Studio

Positron-only Providers

The providers in this section are available only in Positron. See the Positron provider documentation for the full list of Positron providers and setup instructions.

GitHub Copilot Preview

GitHub Copilot works as a model provider in Positron. Ensure you have a GitHub account with Copilot enabled.

To set up GitHub Copilot Preview in Positron:

1. Run the Authentication: Configure Language Model Providers command from the Command Palette.
2. Select GitHub Copilot from the provider list.
3. Authenticate through the browser when prompted.
4. If you use GitHub Enterprise (GHE.com), add your enterprise URL to the github-enterprise.uri setting. Then configure authProvider as "github-enterprise" in settings.json under github.copilot.advanced.