Kimi

Kimi Code CLI is Moonshot AI’s terminal coding agent (kimi). Use varlock to inject KIMI_API_KEY at runtime so the key never sits in a plain text .env or shell history.

For install, schema setup, and shared patterns, see the AI Tools overview.

Launch command: kimi

Authentication: You can sign in interactively with /login (Kimi Code OAuth or a platform API key), or inject a key via the environment. See environment variables.

Environment variable: KIMI_API_KEY (optional: KIMI_BASE_URL if you use a custom endpoint)

In a project

Add to .env.schema:

# @sensitive @required
KIMI_API_KEY=op(op://api-local/kimi/api-key)

Tip

You can use any secrets provider you want, but we like 1Password since it uses biometric authentication for local access. All the examples in this guide use the 1Password plugin (op()) to show more real world examples. See that page for plugin setup and auth options.

varlock run -- kimi

From any directory

Personal schema at ~/.env.kimi:

~/.env.kimi

# @sensitive @required
KIMI_API_KEY=op(op://api-local/kimi/api-key)

varlock run -p ~/.env.kimi -- kimi

Shell alias (optional)

alias vkimi='varlock run -p ~/.env.kimi --no-redact-stdout -- kimi'

--no-redact-stdout keeps Kimi’s own terminal output unredacted while secrets stay out of your shell history.

See the Kimi Code getting started guide for install options and login flows.