A model appearing in a provider's list does not mean your key can call it. Plans, regions, credits and rate limits all decide that. Teams usually find out when a run fails halfway with an invalid key or a model not found error.
Keeping the key in a connection object, separate from the agents and runners that use it, solves two problems. The key lives in one place, as a secret, instead of in every runner's configuration. And the connection can check its models ahead of time with one real call each, so the choice of model is made from the ones that work.