API Key and Environment Variables

Lesson updated November 2, 2026 based on API keys and profiles: the key entered during installation goes into the system keychain (the ~/.vibe/.env file is only a fallback), browser login is offered by default, and /status or /whoami indicate the source used. Source: API keys and profiles.

Get Your Mistral API Key

To use Vibe, you need a Mistral API key. This key authenticates your requests and lets Vibe communicate with Mistral models. Without it, the tool installs and launches, but no generation is possible. You create the key on the Mistral Console in six steps:

1. Go to console.mistral.ai
2. Create an account or log in
3. Navigate to the API Keys section
4. Click Create new key
5. Give it a descriptive name (e.g., “vibe-cli-dev”)
6. Copy the key immediately—it won’t be shown again

That last point isn’t a formality: the key is visible only once. If you close the tab too soon, you’ll have to generate a new one. The key follows the format sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx and must remain confidential. Anyone who has it can use your API quota—and therefore spend your budget.

Three Configuration Methods

Vibe accepts three ways to provide this key. Your choice depends entirely on your work context.

Method 1: Interactive Setup

This is the default method on first launch and the simplest for a personal workstation. Vibe asks for your key directly and saves it:

vibe
# → "Please enter your Mistral API key:"
# Paste your key, press Enter

The key is stored in your system keychain (macOS Keychain, Windows Credential Manager…). If no keychain is available, it falls back to the ~/.vibe/.env file, which is readable only by you. Note that on first launch, logging in via your browser with your Mistral account often removes the need for a key entirely. To see which source Vibe is actually using, type /status or /whoami during a session.

# If the key is in the .env file (no keychain available)
cat ~/.vibe/.env
# MISTRAL_API_KEY=...

Method 2: Environment Variable

As soon as you leave the personal workstation environment—such as a CI/CD pipeline, an automated script, or a shared server—an environment variable becomes preferable because it writes nothing to disk:

export MISTRAL_API_KEY="sk-your-key-here"

To make it persistent on your machine, add this line to your shell configuration file:

# In ~/.bashrc, ~/.zshrc, or ~/.profile
export MISTRAL_API_KEY="sk-your-key-here"

The environment variable takes priority over the .env file. This enables a very practical usage pattern: temporarily switching keys without making permanent changes. You might work with your development key, then prefix a single command with a different key for a sensitive operation:

# Development key
export MISTRAL_API_KEY="sk-dev-xxxx"
vibe "Analyze this code"

# Production key (temporary)
MISTRAL_API_KEY="sk-prod-yyyy" vibe "Deploy migrations"

Method 3: config.toml File

Finally, you can reference the environment variable in Vibe’s TOML configuration file:

# ~/.vibe/config.toml
api_key_env_var = "MISTRAL_API_KEY"

Note that this parameter does not contain the key itself, only the name of the variable to read. This indirection makes sense when working with multiple providers, each with its own variable: api_key_env_var tells Vibe which one to use for the default key.

Priority Order

When multiple methods are configured simultaneously, Vibe applies this order:

1. Environment variable MISTRAL_API_KEY (if defined in the shell)
2. .env file in ~/.vibe/.env
3. System keychain, where the setup wizard stores the key

For a custom provider, api_key_env_var in config.toml simply designates the variable to read, following the same order.

Remember the first line above: if a request fails authentication even though your .env contains a valid key, first check whether an old variable is lingering in your shell and overriding it.

API Key Security

The first rule is to never commit your key to a Git repository. Add .env to your .gitignore before you even create the file. A secret pushed to a public repo is considered compromised, even if you delete the commit later. By the same logic, do not share your key in plain text in a message or document. If you suspect a leak, regenerate it immediately.

Organizationally, use separate keys for development and production. If one leaks, you can revoke it without interrupting the other. Finally, set spending limits on the Mistral Console. This is the most effective safety net against a looping script or an exposed key: the billing stops automatically.

Verify the Key Works

After configuration, don’t assume anything. Test with a minimal request:

vibe "Say hello"

If the key is valid, Vibe responds normally. If it is invalid or expired, you’ll get a clear authentication error, saving you from hunting for the cause in the installation.

If you configure additional providers like OpenRouter, each needs its own variable. The two coexist without issue:

export MISTRAL_API_KEY="sk-mistral-xxxx"
export OPENROUTER_API_KEY="sk-or-xxxx"

We’ll cover third-party provider configuration in detail in the dedicated lesson.

Key Takeaways

• Get your Mistral API key at console.mistral.ai
• Three configuration methods: interactive setup, environment variable, config.toml
• The environment variable takes priority over the .env file
• Never commit your key to Git
• Set spending limits on the Mistral Console