Tree sync for 0.2.106: per-model auth providers for rotating gateway tokens, plus README coverage of the new credential flow.
Changelog
[new] Per-model auth providers — named credential helpers ([auth_provider.<name>] in config) that mint rotating bearer tokens for specific models (e.g. LiteLLM or a corporate proxy), while xAI models keep normal session login
[new] Models can set auth_provider = "<name>"; credential resolution is now api_key → env_key → cached auth-provider token → session token → XAI_API_KEY (a cache miss does not fall back to the session token)
[new] Provider commands use the same stdout contract as auth_provider_command (bare token or JSON with access_token / expires_in); optional token_ttl_secs and timeout_secs; in-memory cache shared across models on that provider
[new] On re-mint, the prior credential is handed back via GROK_AUTH_PROVIDER_ACCESS_TOKEN (and when present GROK_AUTH_PROVIDER_REFRESH_TOKEN / GROK_AUTH_PROVIDER_EXPIRES_AT); GROK_AUTH_EXPIRED=1 is set on refresh runs
[changed] Provider tables are honored only from trusted config layers (~/.grok/config.toml, managed config, requirements) — a project .grok/config.toml cannot define them; first-party xAI credentials are stripped from the helper environment
Docs
shell-README: new “Per-Model Auth Providers” section (config examples, stdout contract, token lifecycle, interaction with api_key/env_key, security notes)
Model config table documents optional auth_provider; credential resolution order updated to match
Under the hood
New shell auth-provider module and e2e coverage for provider mint/refresh behavior
Additional minimal-mode pager e2e tests around commits/thinking scrollback; one older minimal transcript test removed
Upgrade notes
No CHANGELOG version bump: still 0.2.106
If you use gateway models with rotating tokens, prefer a trusted-layer auth_provider over putting long-lived secrets in api_key/env_key; keep helpers fast and non-interactive
