---
title: Wire provider credentials for JS and go runner
description: Resolve provider credentials through Geppetto/Pinocchio profiles and pass final settings to engines.
doc_version: 1
last_updated: 2026-07-02
---


# Wire provider credentials for JS and go runner

Provider credentials belong in Geppetto/Pinocchio profile registries. Applications should resolve the selected profile stack, receive final merged inference settings, and pass those settings to engine or embedding factories.

Use the user's registry by default:

```text
~/.config/pinocchio/profiles.yaml
```

Go applications should expose profile selection rather than provider-key flags:

```go
resolved, err := profilebootstrap.ResolveCLIEngineSettings(ctx, parsedValues)
if err != nil {
    return err
}
defer resolved.Close()

engine, err := factory.NewEngineFromInferenceSettings(resolved.FinalInferenceSettings)
if err != nil {
    return err
}
```

JS applications should use profile-aware APIs or runtime settings produced from a resolved profile. If a command needs to override chat-layer details, use the Geppetto chat/profile flags so the final settings still come from the same merge path.

Do not read provider keys directly in application code. Keep keys in profile base layers, such as an OpenAI base profile, and stack model-specific chat or embedding profiles on top.