docs: own-key OpenAI-compatible endpoints + Jun 24 changelog

[indykish]

Documents the custom OpenAI-compatible endpoint surface from the dashboard-polish milestone (PR #444 in the product repo), and the Jun 24 changelog entry.

• Changelog — Jun 24 entry: terminal-native dashboard, custom endpoints, unified install.
• fleets/credentials — model-provider (own-key) credential section: typed flags, base_url validation, tenant provider add activation.
• cli/agentsfleet — openai-compatible credential add form + the tenant provider subcommands (previously undocumented).
• error-codes — new UZ-PROVIDER-005; corrected UZ-PROVIDER-003 (api_key optional for openai-compatible) and UZ-PROVIDER-004 (openai-compatible bypasses the catalogue).

🤖 Generated with Claude Code

Greptile Summary

This PR documents the custom OpenAI-compatible endpoint surface introduced in the dashboard-polish milestone, covering new CLI typed flags for model-provider credentials, updated error code descriptions, and the Jun 24 changelog entry.

• api-reference/error-codes.mdx — corrects UZ-PROVIDER-003 and UZ-PROVIDER-004 to reflect the openai-compatible path, and adds UZ-PROVIDER-005 for invalid/unsafe base_url values.
• fleets/credentials.mdx — adds a new "Model-provider credentials" section explaining the typed-flags credential form and base-URL validation; exit codes 4 and 5 in the adjacent section were not updated to cover the new path.
• cli/agentsfleet.mdx — adds the openai-compatible credential add example and updates tenant provider add to reflect catalogue-bypass behaviour for custom endpoints; previously flagged duplicate-section and square-bracket issues are resolved.

Confidence Score: 5/5

Documentation-only change with accurate cross-file consistency; safe to merge.

All four files are documentation updates with no executable code. The error-code corrections, CLI examples, and credential-section additions are internally consistent and cross-reference each other correctly. The one gap — exit codes 4 and 5 not covering the new typed-flags path — is a minor documentation omission that doesn't block readers from using the feature.

fleets/credentials.mdx — the exit-code list predates the typed-flags path and should be updated.

Important Files Changed

Filename	Overview
api-reference/error-codes.mdx	Corrects UZ-PROVIDER-003/004 descriptions and adds new UZ-PROVIDER-005 for invalid/unsafe base_url; accurate and internally consistent.
changelog.mdx	Adds Jun 24 changelog entry covering dashboard polish, OpenAI-compatible endpoints, unified install flow, and a DNS-rebinding security fix; well-structured and consistent with other files.
cli/agentsfleet.mdx	Adds typed-flags credential add example for openai-compatible, updates tenant provider add heading and description to reflect catalogue bypass; previous duplicate-section and square-bracket issues are resolved.
fleets/credentials.mdx	Adds new model-provider credentials section with openai-compatible walkthrough, but exit codes 4 and 5 still describe only the --data path and don't cover missing/invalid typed flags.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[agentsfleet credential add] --> B{--data or typed flags?}
    B -->|--data JSON| C[Tool secret\nraw-JSON vault entry]
    B -->|--provider --base-url --model| D[Model-provider credential\nopenai-compatible]
    D --> E{Parse-time validation}
    E -->|non-https base_url| F[Exit 5 — rejected, no network call]
    E -->|valid| G[Stored in vault]
    C --> G
    G --> H[agentsfleet tenant provider add\n--credential name]
    H --> I{Server-side validation}
    I -->|named provider| J[Resolve context cap\nfrom cap.json endpoint]
    I -->|openai-compatible| K[Validate base_url: https +\npublic host, no loopback/\nprivate/cloud-metadata]
    K -->|unsafe| L[UZ-PROVIDER-005 rejected]
    K -->|valid| M[Pinned — bypasses\ncaps catalogue]
    J --> N[Model must be in\ncore.model_caps]
    N -->|absent| O[UZ-PROVIDER-004]
    N -->|present| M
    M --> P[Self-managed runs:\nper-second fee only,\nbills your provider]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[agentsfleet credential add] --> B{--data or typed flags?}
    B -->|--data JSON| C[Tool secret\nraw-JSON vault entry]
    B -->|--provider --base-url --model| D[Model-provider credential\nopenai-compatible]
    D --> E{Parse-time validation}
    E -->|non-https base_url| F[Exit 5 — rejected, no network call]
    E -->|valid| G[Stored in vault]
    C --> G
    G --> H[agentsfleet tenant provider add\n--credential name]
    H --> I{Server-side validation}
    I -->|named provider| J[Resolve context cap\nfrom cap.json endpoint]
    I -->|openai-compatible| K[Validate base_url: https +\npublic host, no loopback/\nprivate/cloud-metadata]
    K -->|unsafe| L[UZ-PROVIDER-005 rejected]
    K -->|valid| M[Pinned — bypasses\ncaps catalogue]
    J --> N[Model must be in\ncore.model_caps]
    N -->|absent| O[UZ-PROVIDER-004]
    N -->|present| M
    M --> P[Self-managed runs:\nper-second fee only,\nbills your provider]

Loading

Comments Outside Diff (1)

1. cli/agentsfleet.mdx, line 476-513 (link)

   Existing "Tenant provider" section is now stale

   The existing detailed section says tenant provider add "resolves the model's context cap from the cap.json endpoint" unconditionally, but the new openai-compatible path explicitly bypasses the catalogue and has no context cap to resolve from cap.json. It also lists "OpenRouter" as a named provider — OpenRouter can now be used via the new custom-endpoint path instead. This section should be updated (or merged with the new stub above) to reflect both paths.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: cli/agentsfleet.mdx
   Line: 476-513
   
   Comment:
   **Existing "Tenant provider" section is now stale**
   
   The existing detailed section says `tenant provider add` "resolves the model's context cap from the `cap.json` endpoint" unconditionally, but the new `openai-compatible` path explicitly bypasses the catalogue and has no context cap to resolve from `cap.json`. It also lists "OpenRouter" as a named provider — OpenRouter can now be used via the new custom-endpoint path instead. This section should be updated (or merged with the new stub above) to reflect both paths.
   
   How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (3): Last reviewed commit: "docs(cli): classify OpenRouter as OpenAI..." | Re-trigger Greptile}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
agentsfleet	🟢 Ready	View Preview	Jun 24, 2026, 1:47 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[indykish]

Addressed the "Existing Tenant provider section is now stale" review — across two commits.

1. cap.json resolution was stated unconditionally → fixed in e9dec5a.
The tenant provider add body now splits the two paths instead of claiming cap resolution for both:

For a named provider it resolves the model's context cap from the cap.json endpoint; an OpenAI-compatible endpoint bypasses the caps catalogue (it bills against your own provider, so its model need not be catalogued).

2. OpenRouter was listed as a named provider → fixed in 50e66ab.
fleets/credentials.mdx and changelog.mdx both reach OpenRouter via the OpenAI-compatible custom-endpoint path, so cli/agentsfleet.mdx now matches them:

- a named provider (Anthropic, OpenAI, Fireworks, Together, Groq, Moonshot, OpenRouter) or [any OpenAI-compatible endpoint] (a self-hosted vLLM server or gateway)
+ a named provider (Anthropic, OpenAI, Fireworks, Together, Groq, Moonshot) or [any OpenAI-compatible endpoint] (a self-hosted vLLM server, a gateway, OpenRouter)

All three files now classify OpenRouter consistently as an OpenAI-compatible endpoint.