Shift Note: Environment Variable Go/No-Go Checks

Clear the scope check before changing the machine

Environment-variable changes are ready to ship only when the intended process receives the intended value. A successful terminal command is not enough: your editor, service or CLI might inherit a different environment. Use this go/no-go checklist before changing configuration on macOS, Linux or Windows.

• Go when you know the variable name, its consumer and whether it contains a secret.
• Go when you have chosen between a temporary session setting, a persistent user setting and a service-specific setting.
• Stop when the proposed fix is a machine-wide API key or an unverified edit to several startup files.

Clear the macOS and Linux shell check

For a temporary setting in Bash or Zsh, run export OPENAI_BASE_URL='https://api.api365relay.com/v1'. That value becomes available to programs launched afterward from that shell. It does not update other terminals, already-running applications or the shell that launched your current shell.

For an interactive Bash or Zsh session, you can enter a token without putting its literal value in shell history: run read -r -s OPENAI_API_KEY, type the token and press Enter, then run export OPENAI_API_KEY. Silent input does not make the resulting environment a secure vault, but it avoids a common history leak.

For persistence, first identify the shell you actually run. Interactive Zsh commonly reads ~/.zshrc, while interactive non-login Bash reads ~/.bashrc. Login Bash reads the first available file among ~/.bash_profile, ~/.bash_login and ~/.profile. On macOS, Terminal commonly starts a login shell; Linux terminal behavior varies.

• Go when a nonsecret export is in the startup file your shell actually reads and a fresh terminal confirms it.
• Stop when you expect shell configuration to configure a desktop application, launchd job, systemd service or container automatically.
• Stop before saving a long-lived token in a startup file unless your security policy explicitly permits that storage.

Clear the Windows process and persistence check

In PowerShell, set a temporary value with $env:OPENAI_BASE_URL = 'https://api.api365relay.com/v1'. In Command Prompt, use set "OPENAI_BASE_URL=https://api.api365relay.com/v1". Both affect the current process and programs it subsequently launches, not unrelated running processes.

For a persistent user-level value in PowerShell, run [Environment]::SetEnvironmentVariable('OPENAI_BASE_URL', 'https://api.api365relay.com/v1', 'User'). Restart the consuming application from a process that has received the updated environment; if inheritance remains stale, signing out and back in refreshes the user session. The persistent write does not update your current PowerShell environment.

• Go when user scope is sufficient and the relaunched consumer sees the value.
• Stop when machine scope is proposed merely to avoid understanding process inheritance.
• Stop before using persistent Windows environment settings as a password vault; use your approved secret store or runtime injection mechanism instead.

Clear the client contract before testing a request

Environment-variable names are conventions, not universal configuration switches. OPENAI_API_KEY and OPENAI_BASE_URL work only when the particular SDK or tool reads them. Some clients require an explicit base-url option, and a .env file does nothing unless your application or tooling loads it.

Relay365 fits when you want a pay-as-you-go relay desk for multiple model families across Claude Code, Codex, Gemini CLI or an OpenAI SDK. Its API base is https://api.api365relay.com; OpenAI clients add /v1. Follow each client's configuration instructions rather than copying OpenAI variable names into every tool. Confirm exact model identifiers before requesting a model such as Gemini 2.5 Flash.

Release only after a redacted verification

• Go when you verify the nonsecret endpoint and check only whether the key is present, without printing it.
• Go when a minimal request succeeds from the actual application context, not merely a separate terminal.
• Stop if logs, screenshots, shell history or committed files expose credentials; revoke exposed keys and replace them.

If a multi-model relay matches your workflow, create a Relay365 account and validate one client first. Keep rollout narrow until inheritance, authentication and rollback are understood.