Configure AI providers for Fox

Choose an LLM provider for Fox, pass API keys as explicit environment variables, and understand how the AWS IMDS lock affects Bedrock access.

Fox runs inside the Hermes container and calls an external LLM provider to power the shop operator. You configure the provider by passing API keys as environment variables. On AWS, the IMDS lock blocks silent VM IAM role access, so you must provide explicit keys or opt out. Learn more about the lock on the IMDS lock page.

Ask Fox about its own provider. Fox knows which provider and model it’s on and what’s in its env.

Try prompts like:

• “Which AI provider are you on right now?”
• “How do I switch you to Anthropic?”
• “Add my OPENAI_API_KEY to the Hermes env.”

Supported provider families

Provider	How to configure	Notes
Anthropic	Add the provider’s documented env var (for example, ANTHROPIC_API_KEY) to the Hermes .env.	Restart Fox after adding the key.
OpenAI	Add the provider’s documented env var (for example, OPENAI_API_KEY) to the Hermes .env.	Restart Fox after adding the key.
AWS Bedrock	Add the provider’s documented env vars (for example, AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) to the Hermes .env.	On EC2 or Lightsail, the IMDS lock blocks the VM IAM role. Provide explicit credentials or opt out.
Other	Add the provider’s documented env vars to the Hermes .env.	Use the same pattern: env vars in .env, do not commit, restart Fox.

Place these variables in the Hermes environment file for your environment (for example, environments/dev/.env or environments/live/.env). Never commit API keys to version control.

Add a provider key

1. Generate an API key

   Choose your provider and create an API key in that provider’s dashboard.

2. Add the key to your environment file

   Open the .env for your environment (root .env for local dev, or environments/<name>/.env per environment). Add the provider’s documented environment variable (for example, ANTHROPIC_API_KEY, OPENAI_API_KEY, or AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY).

3. Restart Fox

   On your local machine:

   pnpm db:hermes:down && pnpm db:hermes:up
   

   On a server:

   pnpm vulpy hermes down && pnpm vulpy hermes up
   
4. Verify the setup

   Run the doctor command to confirm Fox can reach the provider:

   pnpm vulpy hermes doctor
   

Bedrock and AWS IMDS

By default, VULPY_IMDS_LOCK=1 installs an nft reject rule that blocks 169.254.169.254 for the host and all containers. This prevents Fox from silently using the EC2 or Lightsail VM IAM role to access AWS services.

If you want Bedrock to authenticate through the VM role instead of explicit keys, set VULPY_IMDS_LOCK=0 before you start Fox. Otherwise, pass explicit Bedrock credentials via environment variables as described above. See the IMDS lock page for full details.

Rotating keys

Rotate keys at the provider dashboard, then update the value in your .env file and restart Fox using the same down/up commands. The project .gitignore already excludes .env files, so keys stay out of version control. Never commit credentials.

Fox proposes actions in the WebUI and you approve them. Provider spend is billed to your own account, not to Vulpy. Set budget alerts and usage limits in the provider dashboard to avoid surprises.

Reference

For provider-specific setup, model selection, and billing details, consult the official documentation:

• Anthropic documentation
• OpenAI platform documentation
• AWS Bedrock documentation

IMDS Lock

Learn how the IMDS lock works and when to disable it.

Fox Overview

Return to the Fox operator overview and core concepts.