Runtime

Configuration

Understand which credentials unlock each workflow, how model names are resolved, and where local configuration is stored.

Credentials

Open Settings in the workbench to set or replace credentials. The same values can be written from the CLI. Only the Gateway key is required for core model-backed work; Logfire credentials are optional and scoped by purpose.

Gateway API key

Runs evaluators and generates evaluator or dataset drafts.

valcore config set-key

Logfire tracing token

Sends Valcore's API, run, row, and agent traces to the Valcore project.

valcore config set-logfire-token

Logfire read key

Queries traces and fetches hosted datasets from the source agent project. It needs project:read and project:read_datasets.

valcore config set-logfire-read-key

Logfire write key

Publishes curated datasets to the Valcore project. It needs project:read_datasets and project:write_datasets.

valcore config set-logfire-write-key

Models and Gateway

Valcore routes model traffic through the Pydantic AI Gateway. Model strings use gateway/<provider>:<model>; bare provider model names are rejected before a request is made.

gateway/anthropic:claude-sonnet-5
gateway/openai:gpt-5
gateway/google:gemini-2.5-pro

Supported Gateway routes are anthropic, openai, google, google-cloud, bedrock, and groq. Suggestions in the editor come from the version of pydantic-ai installed with Valcore, but any well-formed Gateway model string can be entered.

Defaults and precedence

Runtime settings resolve from highest to lowest priority: an explicit command or API argument, a VALCORE_* environment variable, config.toml, then the built-in default.

Model

VALCORE_DEFAULT_MODEL, config key model, then gateway/anthropic:claude-sonnet-5.

Concurrency

VALCORE_DEFAULT_CONCURRENCY, config key concurrency, then 8.

Database

--db, VALCORE_DB_PATH, config key db_path, then the workspace database.

An exported PYDANTIC_AI_GATEWAY_API_KEY or LOGFIRE_TOKEN takes precedence over its stored value. Logfire read and write API keys are read from the config file rather than exported to the environment.

Logfire project boundary

Most teams should use two projects. The source agent project contains production traces and any hosted datasets you want to sample; the read key points there. The Valcore project receives workbench telemetry, Logfire experiments, and published datasets; the tracing token and write key point there.

If both roles genuinely use one project, valcore config set-logfire-key stores one API key as both read and write. Otherwise, keep the scopes separate.

Valcore normally resolves Logfire links from the API key. Configure a fallback SQL Workbench URL only when project lookup is unavailable:

valcore config set-logfire-explore-url   https://logfire-us.pydantic.dev/org/project/explore

Storage and security

Configuration is stored at ~/.valcore/config.toml with mode 0600. Settings masks stored credentials, and valcore config get reports Logfire credentials only as present or absent. The Gateway key is also masked unless --show-key is explicitly supplied.

valcore config get
valcore config get --json
valcore config path
valcore config edit

Valcore warns if the config file is group- or world-readable. See CLI & automation for relocating the workspace or choosing another database.