Function resolve_api_key 

pub fn resolve_api_key(
    provider: Provider,
    explicit: Option<String>,
    cohere_env: Option<String>,
) -> Option<String>

Pick the API key to send, or None to send no Authorization header at all.

• explicit — what the user handed us for this call: --api-key, the api_key= argument, or our own $RAQEEM_API_KEY. Applies to any backend, because it is scoped to raqeem rather than to a vendor.
• cohere_env — $COHERE_API_KEY. Scoped to Cohere by its name, so it is a fallback for Provider::Cohere and nothing else.

The asymmetry is the whole point: a self-hosted or third-party endpoint reached via --endpoint must never be handed a Cohere key just because one happens to be exported. That would ship the user’s credential to a server Cohere doesn’t control.