With --secret-input-mode ref, onboarding writes env-backed refs instead of plaintext key values.
For auth-profile backed providers this writes keyRef entries; for custom providers this writes models.providers.<id>.apiKey as an env ref (for example { source: "env", provider: "default", id: "CUSTOM_API_KEY" }).Non-interactive ref mode contract:
Set the provider env var in the onboarding process environment (for example OPENAI_API_KEY).
Do not pass inline key flags (for example --openai-api-key) unless that env var is also set.
If an inline key flag is passed without the required env var, onboarding fails fast with guidance.
Interactive onboarding behavior with reference mode:
Choose Use secret reference when prompted.
Then choose either:
Environment variable
Configured secret provider (file or exec)
Onboarding performs a fast preflight validation before saving the ref.
If validation fails, onboarding shows the error and lets you retry.
Non-interactive Z.AI endpoint choices:Note: --auth-choice zai-api-key now auto-detects the best Z.AI endpoint for your key (prefers the general API with zai/glm-5).
If you specifically want the GLM Coding Plan endpoints, pick zai-coding-global or zai-coding-cn.
