SRSafetyRouter Talk to us
Compatible now

1. Create a dedicated identity

In the SafetyRouter tenant portal, create a separate API key for this Copilot CLI installation. Give it a recognizable name and project tags, then allow a model that supports both tool calling and streaming.

2. Configure macOS or Linux

Run these commands in the same terminal session that will launch Copilot CLI. Replace the tenant, API key, and model when needed.

export COPILOT_PROVIDER_TYPE="openai"
export COPILOT_PROVIDER_BASE_URL="https://dsi.safetyrouter.io/v1"
export COPILOT_PROVIDER_API_KEY="sr_live_REPLACE_WITH_YOUR_KEY"
export COPILOT_MODEL="~deepseek/deepseek-flash-latest"
export COPILOT_OFFLINE="true"

copilot

3. Configure Windows PowerShell

PowerShell environment variables use $env: and remain active for the current PowerShell session.

$env:COPILOT_PROVIDER_TYPE = "openai"
$env:COPILOT_PROVIDER_BASE_URL = "https://dsi.safetyrouter.io/v1"
$env:COPILOT_PROVIDER_API_KEY = "sr_live_REPLACE_WITH_YOUR_KEY"
$env:COPILOT_MODEL = "~deepseek/deepseek-flash-latest"
$env:COPILOT_OFFLINE = "true"

copilot
Use exact values

The base URL is plain text—not a Markdown link—and must end in /v1. The model ID must exactly match a model allowed by both the tenant policy and this API key.

What offline mode means

With COPILOT_OFFLINE=true, Copilot CLI does not contact GitHub, does not attempt GitHub authentication, and disables telemetry. It still connects to the configured SafetyRouter URL. A public SafetyRouter tenant is therefore private-routed, not air-gapped. GitHub-hosted features such as /delegate, GitHub Code Search, and the GitHub MCP server are unavailable in this mode.

Keep keys out of shell profiles

Session variables avoid permanently writing the SafetyRouter key into a profile. If you choose persistent configuration, protect the profile and rotate the corresponding SafetyRouter identity if the machine or file is exposed.

4. Verify the route

Start Copilot CLI and send a simple request. Confirm that the request appears under the dedicated identity in SafetyRouter's Requests page. For provider diagnostics, run:

copilot help providers

BYOK variables, model requirements, and offline-mode behavior verified against GitHub's official Copilot CLI BYOK guide and authentication documentation.

Buffered-safety timeout

Allow up to 15 minutes

SafetyRouter intentionally waits for input review, model generation, and output review before releasing model content. Where your client exposes request, response-header, socket-read, or stream-idle timeouts, set them to at least 900000 ms or 900 seconds. Keep streaming enabled. A longer timeout preserves the safety boundary; it does not bypass inspection.