Skip to main content
Your chatLanguageModels.json should list only the models authorized for your data’s classification. Choose the compliance level your data classification and authorization require, list models at that level, and do not mix levels within a single file. Step 1 gives two examples to base yours on: an ITAR configuration and an All models configuration.The gateway enforces the compliance boundary for the models it serves, but it does not control client-side behavior: local tool execution, file access, outbound destinations, and so on. Client-side behavior is the customer’s responsibility.
GitHub Copilot Chat in VS Code supports Bring Your Own Key (BYOK), letting you register custom OpenAI-compatible model providers. Point it at Consus Gateway to get Claude and GPT models in your editor while keeping all traffic within government-authorized cloud infrastructure.

​
Before you start

You need:
  • A Consus API key from your Consus admin.
  • A recent version of VS Code with the GitHub Copilot Chat extension (BYOK custom endpoints).

​
Step 1: Configure Consus as a BYOK provider

VS Code stores custom BYOK endpoints in chatLanguageModels.json. Let VS Code create the file and capture your key, then paste in the model list.
  1. Open the Command Palette (Cmd/Ctrl+Shift+P) and run Chat: Manage Language Models (or click the gear icon in the model picker in the Chat view).
  2. Select Add Models, then choose Custom Endpoint from the provider list.
  3. Enter a group name (for example Consus Gateway), select the API type Chat Completions, and paste your Consus API key when prompted. VS Code stores the key in the operating system’s secret storage (Keychain on macOS, Credential Manager on Windows, libsecret on Linux) and opens chatLanguageModels.json with a provider block already filled in:
    The apiKey value is an input variable that points at the stored secret; the generated name varies. Leave it as is. The key itself never appears in the file, so the file is safe to share.
  4. Replace the empty models array with one of the lists below and save. Every entry sends the stored key through "x-api-key": "${apiKey}", which VS Code substitutes at request time.
The file lives in your VS Code User directory, alongside settings.json:
  • macOS: ~/Library/Application Support/Code/User/chatLanguageModels.json
  • Linux: ~/.config/Code/User/chatLanguageModels.json
  • Windows: %APPDATA%\Code\User\chatLanguageModels.json
(For VS Code Insiders, substitute Code - Insiders for Code.) Choose the list that matches your data classification: one scoped to ITAR / export-controlled data, one listing a broad set of models across compliance levels. Adapt either to your authorization, and do not mix levels within a single file.
To change the stored key later, run Chat: Manage Language Models, select the Consus provider, and choose the option to update its API key. If you are writing the file by hand instead of using Add Models, use "apiKey": "${input:consusApiKey}"; VS Code prompts for the key the first time a model in the group is used.

​
Example: ITAR

Use this when handling ITAR / export-controlled data. It exposes every model with ITAR authorization: Claude Opus 5, Claude Opus 4.8, Claude Sonnet 5, Claude Sonnet 4.5, Grok 4.6, GPT-5.4, GPT-5.6 Terra, GPT-5.6 Luna, and GPT OSS 120B on AWS GovCloud Bedrock, plus GPT-5.1 and GPT-5.6 Sol on Azure Government OpenAI. Opus 4.8 and Grok 4.6 are offered for ITAR only, and Opus 5’s ITAR traffic is served from Bedrock, so those use the standalone :itar ID (Opus 5’s FedRAMP-level IDs route to Vertex AI instead).
Grok 4.6 needs the modelOptions block shown below. Copilot Chat sends top_p on every request, and xAI models on Bedrock reject any sampling parameter with a 400. Setting top_p and temperature to null in modelOptions strips them from the request. Claude, GPT, and Gemini models accept these parameters, so the block is only required on Grok entries.

​
Example: All models

Lists the models people actually reach for, spanning several compliance levels so you can switch from the chat model picker mid-session. Each id carries its own level; trim this list, or swap the levels (:il5+itar, :itar, :il2, :il4, :fedramp-high, and so on), to match your data classification and authorization.
This is a starting point. Trim it to the models you actually use, or add any other authorized model with the same shape. Run curl -H "x-api-key: $CONSUS_API_KEY" https://api.consus.io/v1/models to list every composite ID available to your key. Every id must carry a compliance level (e.g. :fedramp-high, :il5, :itar); a bare model name is rejected with a 400.
Signing out of GitHub in VS Code disables the built-in Copilot models, so the only model that actually serves requests is Consus. This guarantees no request silently falls back to a non-authorized model. (Auto may still appear in the picker, but it won’t work — see the note in Step 3.)
  1. Sign out of GitHub in VS Code. Click the account icon (bottom-left), select your GitHub account, and click Sign Out.
  2. Restart VS Code.
  3. Open settings.json (Cmd/Ctrl+Shift+P → Preferences: Open User Settings (JSON)) and add utility model overrides so background tasks also route to Consus instead of a built-in:
    Set both to a model id from your chatLanguageModels.json.

​
Step 3: Select the model and verify

  1. Open the chat model picker and select a Consus model (for example GPT-5.4 (ITAR)).
  2. Send a test prompt. Confirm it responds and that no Copilot credits are consumed — zero credits means the request was served by Consus, not a Copilot built-in.
Auto may still appear in the picker even after signing out, but it won’t work — selecting it does nothing. Ignore it and always pick a Consus model explicitly.
All requests now route through Consus Gateway to government-authorized cloud infrastructure. Streaming, tool use (file reads, writes, terminal commands), and multi-turn conversations all work out of the box.

​
What gets served

Every request from Copilot Chat — coding turns, reasoning, tool use — is served by the model you select in the picker, at the compliance level set in its id. The gateway routes each request to whichever government-authorized provider hosts that model at the requested compliance level (AWS GovCloud Bedrock, GCP Assured Workloads Vertex AI, Azure Government OpenAI); the compliance boundary is enforced at the gateway architecture level. VS Code talks to the gateway over the OpenAI-compatible Chat Completions API. For the full request/response surface (multimodal input, streaming behavior, tool-use shape), see POST /v1/chat/completions.

​
What each setting does

name : Display name for the provider group in VS Code. vendor : customendpoint tells VS Code this is a custom OpenAI-compatible provider rather than a built-in. apiType : chat-completions selects the OpenAI-compatible Chat Completions wire format, which the gateway exposes for every provider (Anthropic, OpenAI, Google). models[].id : The composite model ID VS Code sends to the gateway. Must include a :level suffix (e.g. :itar, :il5+itar, :fedramp-high). models[].url : Routes the request to the gateway’s OpenAI-compatible endpoint (https://api.consus.io/v1). apiKey : An input variable (${input:...}) pointing at the key VS Code stored in secret storage during Add Models. Never paste a raw key here. models[].requestHeaders."x-api-key" : Sends your Consus key on every request. Consus authenticates with the x-api-key header, not Authorization: Bearer. The ${apiKey} token is replaced with the stored key at request time. models[].toolCalling : true enables tool/function calling — required for Copilot’s agentic coding (file edits, terminal commands). models[].vision : true for models that accept image input; false for text-only models such as GPT OSS 120B. models[].maxInputTokens / maxOutputTokens : The model’s input context window and the maximum output tokens requested per turn. The examples use the gateway catalog’s limits; setting maxOutputTokens above a model’s cap returns a 400 from the provider. models[].modelOptions : Request parameters merged into every call. Setting a parameter to null removes it from the request. Required on Grok 4.6 as { "top_p": null, "temperature": null }, because xAI models on Bedrock reject both fields. models[].thinking / supportsReasoningEffort / reasoningEffortFormat : Set on reasoning-capable models. thinking: true marks the model as a reasoning model, supportsReasoningEffort lists the effort levels the picker offers, and "reasoningEffortFormat": "chat-completions" sends the choice as a top-level reasoning_effort, which the gateway maps to each provider’s native thinking control and clamps to the model’s supported range. chat.utilityModel / chat.utilitySmallModel : (settings.json) The models VS Code uses for background/utility tasks. Point them at a Consus id so utility calls don’t fall back to a Copilot built-in.

​
Troubleshooting

401 Unauthorized: The stored key is missing or wrong. Run Chat: Manage Language Models, select the Consus provider, and re-enter the key. Confirm each model’s requestHeaders contains "x-api-key": "${apiKey}". 403 Forbidden: An Authorization: Bearer token reached the gateway, or the header name is misspelled. Consus authenticates only via x-api-key (all lowercase, with hyphens). 400 The request was invalid. Check your parameters. on Grok 4.6 only: Copilot sent top_p, which xAI models on Bedrock reject. Add "modelOptions": { "top_p": null, "temperature": null } to the Grok entry, as in the examples above, and reload the window. 400 ... compliance level required: A model id is missing its :level suffix (e.g. gpt-5.4 instead of gpt-5.4:itar). Add the level your authorization requires. Model not appearing in the picker: chatLanguageModels.json didn’t parse. Validate it (python3 -m json.tool chatLanguageModels.json), fix any error, and reload the window. Copilot credits being consumed: The request was served by a Copilot built-in, not Consus. Confirm you selected a Consus model, and sign out of GitHub (Step 2) to remove built-ins entirely.