Configuration and Credentials
Connect Telemus AI to an AI provider, then add the services you want to use. Availability depends on your installed build, platform, provider account and license. Connecting your Telemus account and connecting an AI provider are separate steps.
Link this device
- In Telemus AI, open Account > Link this device or Settings > Link this device. During first run, choose CONNECT PROVIDER at Connect AI.
- Keep the Device Link card open. Scan its QR code or enter its hyphenated code in Telemus Portal. Older six-digit codes remain accepted where shown.
- Sign in to your Telemus account and confirm that the browser and app show the same device code.
- Review the provider settings you want to apply, then save them.
- Return to the app and wait for completion. If the code expires, use the new code shown by the app.
If the headset cannot open a browser, use the displayed QR code or full URL on a phone or computer. The Device Link page is available at device.telemus.ai.
Choose DEMO MODE if provider credentials are not ready. Account linking can be completed before choosing a model; a provider key does not fix an account-link or network error.
Choose an AI provider
The provider and model choices shown in your installed build are authoritative. A provider appearing in the catalog does not guarantee access to every model, capability or sign-in method. Your provider's account permissions and charges still apply.
| Connection | What you need |
|---|---|
| OpenAI API | An OpenAI API key with access to the features you use. |
| OpenAI / Codex OAuth | Complete the available browser sign-in flow. This connects supported Codex text/model features. |
| Other hosted providers | The provider's supported credentials and an available model. |
| Local model services | A running compatible service, the configured endpoint, and any credentials that service requires. |
| External agent integrations | The supported agent application and its own completed setup. |
The catalog includes OpenAI, Anthropic, Google Gemini, OpenRouter, Nous, xAI, DeepSeek, Mistral, Moonshot/Kimi, MiniMax, Qwen and Alibaba Cloud, as well as additional regional and hosted providers. Available gateway and enterprise choices include Azure AI Foundry, AWS Bedrock, Cloudflare AI Gateway, LiteLLM and Vercel AI Gateway. Supported local options include Ollama, LM Studio, SGLang and vLLM. Check the provider list in your build for the current selection.
An API KEY CONNECTED status lets you continue with that key. The optional OPENAI / CODEX OAUTH action remains separate. OAuth-only setup connects text; OpenAI realtime voice, text-to-speech, images, transcription and embeddings need separate API-key access where supported. A ChatGPT subscription does not grant that API usage.
Web realtime voice also requires a supported runtime credential setup. Browser sign-in or an HTTP proxy alone does not enable it. Never put a provider key in publicly served files or browser-visible build configuration.
Model selection
Telemus AI default follows the app's current default model, including in saved sessions. Selecting a specific model keeps that override. If the provider rejects a selected model, choose one available to your account.
Supported reasoning controls vary by provider and model. A reasoning display preference in the Web interface does not necessarily change the native model's reasoning setting. Check the applied status before relying on it.
OpenAI authentication and charges
When both Codex OAuth and an OpenAI API key are connected, supported text turns
prefer OAuth. A failure or temporary provider restriction can cause a fallback
to the API key, which can incur API charges. Native operators who intentionally
want key-first behavior can set openai_auth_preference=api_key or
VRAI_OPENAI_AUTH_PREFERENCE=api_key.
Quota exhaustion, authentication errors and rate limits can temporarily make a
provider unavailable. Use model_failover_status to inspect redacted provider
status, then check the provider account or choose another configured service.
Repeated retries do not replenish provider credit.
Advanced native configuration supports openai_service_tier values auto,
default, flex and priority. An explicit tier takes precedence over
openai_fast_mode=on. These are app-wide settings for eligible OpenAI requests;
priority can increase provider charges.
In supported channel conversations, /fast shows the current selection,
/fast on requests priority on eligible requests and /fast off disables that
conversation's fast hint. An explicit app-wide tier can still apply, so
/fast off is not a spending limit. Provider billing remains authoritative.
Manage settings and credentials
In Telemus Portal, select the intended linked device under Device settings. Account, security, linked-account and notification preferences have separate sections. A setting saved for one linked device is not an instruction to change all your devices.
- Non-empty values replace the selected device's current value. Blank secret fields keep the existing value.
- Secret fields are write-only; saved keys are not shown back in the page.
- Keep Telemus AI open and connected while waiting for settings to arrive.
- Use the app's status after saving to confirm that the setting applied.
- Comfort options include text size, UI scale, reduced motion, hold-to-talk, seated mode and high contrast where supported.
The local Web Command Center can also accept supported write-only provider credentials. Use the supported setup controls rather than copying keys into chat, notes, screenshots or shared documents.
Android uses platform-backed secret storage. Desktop builds use the operating system's secret service where available, with restricted local storage when that service is unavailable. Review your device's access controls and avoid sharing an operating-system account that holds your credentials.
Connect a messaging channel
- Open Quick Connect or Channels Center and choose a connector.
- Select Open Portal to open the selected device's setup checklist.
- Follow the connector's requirements and configure credentials where the app or companion relay runs.
- Return to the app and select Test. Complete any QR pairing, companion or provider callback steps shown there.
- Choose whether Telemus responds when mentioned, responds throughout the selected channel, or remains off.
Use Finish Later to resume setup later, or More Channels for the advanced catalog. Channel status distinguishes a completed checklist from a working connection. A send only connector may still need an incoming HTTPS callback, a host worker or a companion application before it can receive messages.
Portal channel credential presence is a setup record; it does not inject the connector's actual credentials into the linked app. Configure those credentials on the app or companion host. Never treat a presence indicator as a successful live connection test.
Mobile relay availability depends on app lifecycle and connectivity. Android can use an explicit foreground service with a visible notification. iOS does not provide continuous background channel connections. For continuous receiving, use a supported desktop or hosted companion and let mobile reconnect when available.
Channel access and privacy
Choose sender and conversation restrictions before connecting a channel to an agent. A permitted group is not automatically a trusted group of operators. Do not connect untrusted peers to an agent with access to private information or privileged actions.
Telegram operators should configure VRAI_TELEGRAM_ALLOWED_USER_IDS before
allowing slash commands. An explicit wildcard grants all identified senders.
Use named sender IDs when access should be limited; an allowed chat alone is
not a general authorization boundary.
Approval requirements still apply to channel actions. Inspect the requested action before approving it. If responder authority or a required connection is unavailable, restore the connection instead of weakening access controls.
Search setup
Search can use configured provider accounts. The supported environment names below are for the trusted process running Telemus AI; they are not browser settings and should not be placed in public assets.
| Search provider | Credential or service setting |
|---|---|
| Brave | BRAVE_API_KEY |
| Exa | EXA_API_KEY |
| Firecrawl | FIRECRAWL_API_KEY |
| Gemini | GEMINI_API_KEY |
| Grok | XAI_API_KEY |
| Kimi | MOONSHOT_API_KEY |
| MiniMax | MINIMAX_API_KEY |
| Perplexity | PERPLEXITY_API_KEY |
| SearXNG | SEARXNG_BASE_URL |
| Tavily | TAVILY_API_KEY |
DuckDuckGo needs no key but can rate-limit or challenge requests. If search is
unavailable, check the reported provider error or use web_fetch with a known
URL. Provider-supplied citations are evidence to inspect, not independent
verification of an answer.
When Codex OAuth is connected, hosted Codex search is enabled by default in
addition to configured search providers. Set search.codex_enabled=false or
VRAI_SEARCH_CODEX_ENABLED=0 to disable that addition. search.codex_mode=cached
requests cached search rather than live access. Provider status shows availability
without exposing credentials.
Memory and conversation privacy
Ask the assistant to remember this or write this down to save a fact.
Use memory_search and memory_get to find saved notes. A saved note is fallible
context: inspect its source and date, especially when entries disagree.
Automatic recall can bring saved notes into trusted local conversations. Shared owner memory is also enabled for channels by default. Canonical or imported notes and trusted owner memories can reach channel peers and the configured model. Private/redacted and superseded sources are excluded.
To disable automatic channel injection, set memory_recall.channels=0 or
VRAI_MEMORY_CHANNELS=0; the environment setting takes precedence. Disable it
before connecting peers who must not see owner information, or mark sensitive
notes private. Changing the setting does not remove information already shared
in conversation history.
Optional memory helpers are off by default and may add model requests, latency and provider charges. Review those settings before enabling them. The Web Operations memory search remains local-only and does not make model or embedding requests.
Embedding requests
VRAI_MEMORY_EMBEDDING_PROVIDER controls whether supported memory embedding
requests use separate provider access:
| Value | Behavior |
|---|---|
auto | Avoid direct OpenAI embedding calls when text uses Codex OAuth. API-key-only setups retain their configured behavior. |
openai | Explicitly allow OpenAI embeddings with an API key, including when text uses OAuth. Separate API charges may apply. |
none | Disable new memory embedding requests. |
VRAI_MEMORY_EMBEDDINGS_ENABLED=0 disables requests regardless of provider choice.
Saved vectors can remain present while new requests are disabled. Use
memory_status to inspect availability; ordinary text search remains available
when embeddings are unavailable.
Long conversations
Long conversations can be summarized to fit a model's available context. Earlier details may need to be restated or reopened from history. A summary or retained record of a completed check is not proof that the entire task succeeded.
Supported Codex subscription models can use server-side compaction. Operators
can set VRAI_CODEX_SERVER_COMPACTION=0 to use client-side compaction only.
Conversation history remains separate from the model's current context.
Persona files
Advanced channel setup can load SOUL.md, USER.md and CHANNEL.md from a
configured persona directory. Include only approved material safe for the intended
audience. The app does not create or populate the directory for you.
Private MEMORY.md loading is restricted to eligible direct conversations;
groups and other unsupported contexts do not receive it. Disable new private-file
reads with channel_persona.memory_direct_chats=false or
VRAI_CHANNEL_PERSONA_MEMORY_DIRECT=0. Existing history is not erased.
Use /personality in Web or TUI to inspect file availability and loading status.
This file-loading option is unavailable on Windows. A missing or unavailable file
must not be treated as loaded.
Hosted workspaces and sync
A hosted browser session uses the server's configured access and provider setup. It does not turn the browser into a linked native device or grant a new license. Use Open Command Center when the hosted view does not support server chat.
A disconnected request may still be running. Use Check turn to reconcile an uncertain result before submitting again. Cancellation asks the server to stop; some work can take time to finish. A reconnect does not resend your message.
Hosted conversation history is temporary and private to that browser session, but normal server tool and audit records follow the operator's retention policy. This is not a guarantee of whole-server erasure or filesystem isolation. Actions requiring approval are unavailable in hosted spatial chat; use the ordinary Command Center workflow.
Hosted local voice requires a click or tap to allow audio and the required voice assets on the server. If speech is unavailable, the text reply remains available.
Use Sync Hubs in the portal for supported hub connections. Confirm that the selected workspace and device are correct, then follow the connection status. Self-hosted and managed offerings have different eligibility and availability. Managed VPS public availability remains restricted; consult the current offering before relying on it. See Cross-Device Sync.
Security and recovery
Keep API keys, passwords, pairing codes and session tokens out of shared notes, source repositories and public files. Use provider controls to revoke credentials that may have been exposed. Do not disable authentication or license checks to work around setup errors.
If secure storage cannot be read or updated, linking can remain blocked. Collect the displayed error for support; do not delete workspace or credential files as a first troubleshooting step.
Continue with First Run, Troubleshooting, Permissions and Release Readiness.