Authentication
The Test Cabinet drives Kilo Code with API-key authentication, against the OpenRouter-backed models it is configured for. For the contracts shared by every harness, see Agent Harnesses → Authentication.
API key
Section titled “API key”Kilo Code reads an OpenRouter API key from OPENROUTER_API_KEY. Export that
variable on the host; The Test Cabinet injects it into the run container under the
same name. Billing is charged against the OpenRouter account backing the key, and
the run’s cost is taken from what Kilo Code reports, or derived from OpenRouter
pricing when it reports only token usage (see Metrics).
The key is supplied only as a container environment secret. It is never written into the seeded repository or committed anywhere.
Subscription
Section titled “Subscription”Subscription-style authentication is not supported for Kilo Code today: The Test Cabinet drives it through the OpenRouter API key above. Subscription support may be added later for the harnesses that can use it.
Selecting a mode
Section titled “Selecting a mode”With only the API-key mode available, the default auto selection resolves to the
API key, and Kilo Code is ready once OPENROUTER_API_KEY is set. The
TCAB_AUTH_MODE lock still applies: TCAB_AUTH_MODE_KILO=subscription simply
leaves the harness unavailable, since it has no subscription mode here.
See the Overview for how Kilo Code is invoked, Events and Metrics for how its output and cost are recorded, and Agent Harnesses for the shared authentication contract.