Skip to main content
Your chatLanguageModels.json should list only the models authorized for your data’s classification. Choose the compliance level your data classification and authorization require, list models at that level, and do not mix levels within a single file. Step 1 gives two examples to base yours on: an ITAR configuration and an All models configuration.The gateway enforces the compliance boundary for the models it serves, but it does not control client-side behavior: local tool execution, file access, outbound destinations, and so on. Client-side behavior is the customer’s responsibility.
GitHub Copilot Chat in VS Code supports Bring Your Own Key (BYOK), letting you register custom OpenAI-compatible model providers. Point it at Consus Gateway to get Claude and GPT models in your editor while keeping all traffic within government-authorized cloud infrastructure.

​
Before you start

You need:
  • A Consus API key from your Consus admin.
  • A recent version of VS Code with the GitHub Copilot Chat extension (BYOK custom endpoints).

​
Step 1: Configure Consus as a BYOK provider

VS Code stores custom BYOK endpoints in chatLanguageModels.json. To create it:
  1. Open the Command Palette (Cmd/Ctrl+Shift+P) and run Chat: Manage Language Models (or click the gear icon in the model picker in the Chat view).
  2. Select Add Models, then choose Custom Endpoint from the provider list.
  3. When prompted, enter a group name and select the API type Chat Completions. VS Code then opens chatLanguageModels.json for editing.
The file lives in your VS Code User directory, alongside settings.json:
  • macOS: ~/Library/Application Support/Code/User/chatLanguageModels.json
  • Linux: ~/.config/Code/User/chatLanguageModels.json
  • Windows: %APPDATA%\Code\User\chatLanguageModels.json
(For VS Code Insiders, substitute Code - Insiders for Code.) Populate it with the models authorized for your data classification. The two examples below use the identical provider block (name, vendor, apiType) and differ only in the models array: one scoped to ITAR / export-controlled data, one listing a broad set of models across compliance levels. Use whichever matches your authorization, or adapt the model list to your classification. Do not mix levels within a single file. Replace <CONSUS_API_KEY> in each requestHeaders block with your actual Consus Gateway API key. VS Code sends this header value literally — it does not expand environment variables, so paste the real key rather than a $VAR reference.
chatLanguageModels.json stores your API key in plain text. Do not commit it to source control; keep it in your local VS Code User directory only.

​
Example: ITAR

Use this when handling ITAR / export-controlled data. It exposes Claude Opus 4.8, Claude Sonnet 4.5, GPT-5.1, GPT-5.4, and GPT OSS 120B, all with ITAR authorization on AWS GovCloud Bedrock. Opus 4.8 is authorized for ITAR only, so it uses the standalone :itar ID.

​
Example: All models

Lists the models people actually reach for, spanning several compliance levels so you can switch from the chat model picker mid-session. Each id carries its own level; trim this list, or swap the levels (:il5+itar, :itar, :il2, :il4, :fedramp-high, and so on), to match your data classification and authorization.
This is a starting point. Trim it to the models you actually use, or add any other authorized model with the same shape. Run curl -H "x-api-key: $CONSUS_API_KEY" https://api.consus.io/v1/models to list every composite ID available to your key. Every id must carry a compliance level (e.g. :fedramp-high, :il5, :itar); a bare model name is rejected with a 400.
Signing out of GitHub in VS Code disables the built-in Copilot models, so the only model that actually serves requests is Consus. This guarantees no request silently falls back to a non-authorized model. (Auto may still appear in the picker, but it won’t work — see the note in Step 3.)
  1. Sign out of GitHub in VS Code. Click the account icon (bottom-left), select your GitHub account, and click Sign Out.
  2. Restart VS Code.
  3. Open settings.json (Cmd/Ctrl+Shift+P → Preferences: Open User Settings (JSON)) and add utility model overrides so background tasks also route to Consus instead of a built-in:
    Set both to a model id from your chatLanguageModels.json.

​
Step 3: Select the model and verify

  1. Open the chat model picker and select a Consus model (for example GPT-5.4 (ITAR)).
  2. Send a test prompt. Confirm it responds and that no Copilot credits are consumed — zero credits means the request was served by Consus, not a Copilot built-in.
Auto may still appear in the picker even after signing out, but it won’t work — selecting it does nothing. Ignore it and always pick a Consus model explicitly.
All requests now route through Consus Gateway to government-authorized cloud infrastructure. Streaming, tool use (file reads, writes, terminal commands), and multi-turn conversations all work out of the box.

​
What gets served

Every request from Copilot Chat — coding turns, reasoning, tool use — is served by the model you select in the picker, at the compliance level set in its id. The gateway routes each request to whichever government-authorized provider hosts that model at the requested compliance level (AWS GovCloud Bedrock, GCP Assured Workloads Vertex AI, Azure Government OpenAI); the compliance boundary is enforced at the gateway architecture level. VS Code talks to the gateway over the OpenAI-compatible Chat Completions API. For the full request/response surface (multimodal input, streaming behavior, tool-use shape), see POST /v1/chat/completions.

​
What each setting does

name : Display name for the provider group in VS Code. vendor : customendpoint tells VS Code this is a custom OpenAI-compatible provider rather than a built-in. apiType : chat-completions selects the OpenAI-compatible Chat Completions wire format, which the gateway exposes for every provider (Anthropic, OpenAI, Google). models[].id : The composite model ID VS Code sends to the gateway. Must include a :level suffix (e.g. :itar, :il5+itar, :fedramp-high). models[].url : Routes the request to the gateway’s OpenAI-compatible endpoint (https://api.consus.io/v1). models[].requestHeaders."x-api-key" : Sends your Consus key on every request. Consus authenticates with the x-api-key header, not Authorization: Bearer. Replace <CONSUS_API_KEY> with your actual key. models[].toolCalling : true enables tool/function calling — required for Copilot’s agentic coding (file edits, terminal commands). models[].vision : true for models that accept image input; false for text-only models such as GPT OSS 120B. models[].maxInputTokens / maxOutputTokens : The model’s input context window and the maximum output tokens requested per turn. chat.utilityModel / chat.utilitySmallModel : (settings.json) The models VS Code uses for background/utility tasks. Point them at a Consus id so utility calls don’t fall back to a Copilot built-in.

​
Troubleshooting

401 Unauthorized: x-api-key is missing or wrong. Verify the requestHeaders."x-api-key" value in chatLanguageModels.json holds your real key. 403 Forbidden: An Authorization: Bearer token reached the gateway, or the header name is misspelled. Consus authenticates only via x-api-key (all lowercase, with hyphens). 400 ... compliance level required: A model id is missing its :level suffix (e.g. gpt-5.4 instead of gpt-5.4:itar). Add the level your authorization requires. Model not appearing in the picker: chatLanguageModels.json didn’t parse. Validate it (python3 -m json.tool chatLanguageModels.json), fix any error, and reload the window. Copilot credits being consumed: The request was served by a Copilot built-in, not Consus. Confirm you selected a Consus model, and sign out of GitHub (Step 2) to remove built-ins entirely.