Step 5 Preview Guide: Pilot a 1M-Context Agent API Safely

Step 5 Preview is StepFun’s flagship model for agentic work, announced on September 20, 2026. Its headline features include a one-million-token context window, text-image-video input, and tool calling. Those capabilities can reduce context stitching, but they do not automatically make a long-running workflow reliable or safe. This guide focuses on a controlled pilot: connect the API, verify the billing channel, test tool execution, measure cost and latency, and add human approval before expanding access.

Quick take
  • The model ID is step-5-preview, with up to 1M input tokens and 64K output tokens.
  • The standard API and Step Plan use different base URLs and separate billing systems.
  • The model proposes tool calls; your application still executes them, validates arguments, handles retries, and enforces permissions.
  • StepFun’s official pages are not fully consistent about prompt-cache support for this model, so verify actual usage before budgeting around cache discounts.

What Step 5 Preview changes

StepFun describes Step 5 Preview as a sparse mixture-of-experts model with 600B total parameters and 27B active parameters per token. The launch emphasizes software engineering, professional knowledge work, finance, multimodal analysis, and tasks that continue for many steps. The model is available through StepFun products and APIs now, while the company says open weights are planned for October 15.

That distinction matters. Today, most readers are evaluating an API preview rather than deploying the weights in their own environment. StepFun’s coding, finance, and long-horizon examples are vendor-run evaluations. They may help form a test plan, but they do not establish how the model will perform in your repository, document set, network, or permission model. A useful pilot should therefore measure intermediate state, recovery from tool errors, spending limits, and the points where a person can stop the run.

What the model supports and what your application owns

AreaDocumented supportPilot check
Input and outputText, image, and video input; text outputEvidence locations, omissions, and OCR quality
ContextUp to 1M input tokens and 64K output tokensRetrieval quality, latency, and cost at realistic lengths
ImagesUp to 60 images by URL or Base64Resolution, detail mode, and token growth
VideoMP4, QuickTime, and Matroska by URL, Base64, or Files API referenceURL video under 128 MB; under five minutes is recommended
Tool callingUp to 128 function definitionsServer-side validation, authorization, execution, and recovery
Long documents, code, images, and video moving through tool boundaries and a human review point in a Step 5 Preview workflow
A one-million-token window provides room for evidence. It does not give the model automatic authority to execute external tools or approve the final result.

Choose the standard API or Step Plan first

StepFun offers a usage-based standard API and a subscription service called Step Plan. The standard OpenAI-compatible Chat Completions base URL is https://api.stepfun.ai/v1, with requests sent to POST /chat/completions. For Step Plan, OpenAI SDK clients use https://api.stepfun.ai/step_plan/v1, while Claude Code and Anthropic SDK clients use https://api.stepfun.ai/step_plan.

The channels have separate balances and allowances. A successful request to the standard endpoint does not prove that Step Plan Credits were used. A Step Plan subscription also does not automatically fund the standard API channel. During the first test, record the base URL, model ID, request ID, and the matching usage entry in the console.

Step Plan uses monthly Credits and currently offers four tiers from Flash Mini to Flash Max. Monthly Credits do not roll over. Its subscription allowance is also separate from the standard API’s top-up-based RPM and TPM table. Compare the expected monthly workload, repeated long prompts, and team access instead of assuming that one billing option is always cheaper.

Prepare a bounded pilot

  1. Safe data: Start with public or de-identified samples. Do not begin with customer records, a complete private repository, or secrets.
  2. Acceptance criteria: Define source traceability, valid JSON, tool-argument accuracy, test results, latency, and a spending ceiling.
  3. Permission tiers: Separate read tools from write tools. Keep deletion, deployment, payments, and outbound messages behind human approval.
  4. Observability: Log request IDs, input and output usage, latency, error codes, tool calls, and tool results.
  5. Stop conditions: Limit consecutive failures, total calls, wall-clock time, and maximum spend.

Make a minimal OpenAI-compatible request

Create an API key, then store it in a local environment variable or secrets manager. Do not hardcode the real key in a repository or browser application. The following Python example is intentionally small so you can verify routing and response structure before adding tools.

export STEP_API_KEY="your_key_here"

pip install -U openai
import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["STEP_API_KEY"],
    base_url="https://api.stepfun.ai/v1"
)

response = client.chat.completions.create(
    model="step-5-preview",
    messages=[
        {"role": "system", "content": "Return concise, sourced analysis."},
        {"role": "user", "content": "List three risks in this sample policy."}
    ],
    reasoning_effort="low",
    max_tokens=800
)

print(response.choices[0].message.content)
print(response.usage)

A printed answer is not the only completion signal. Check the returned model, usage object, finish reason, and corresponding console record. Preview-model access can change by account and channel. If the server returns model does not exist, verify the account’s current permissions and official model list rather than guessing another identifier.

Verify tool calling as a two-stage loop

In a tool workflow, the model proposes a function name and arguments. Your application validates those arguments, runs the function, and sends the result back in a tool message. Receiving tool_calls in the first model response does not mean the requested task has been completed.

  1. Expose one read-only calculator or lookup function.
  2. Validate the schema, string length, identifiers, and allowed values on the server.
  3. Return a status code and evidence with the tool result.
  4. Call the model again and compare the final answer with the tool output.
  5. Add a narrowly scoped write tool only after the read-only loop is reliable.

The documentation allows up to 128 function definitions, but a large catalog creates more selection errors and a wider permission-review surface. Measure wrong-tool selection and invalid arguments with a small set before expanding it.

Contract analysis, code changes, and multimodal evidence passing through accuracy, tool execution, cost, and data-handling tests before human approval
Separate pilot workloads and pass each one through accuracy, execution, cost, and data-handling checks before a human approves production access.

Enable the 1M window in Claude Code

StepFun’s integration guide places the configuration in the user-level ~/.claude/settings.json file. For Step Plan, the essential fields are ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL, and model. Merge them with existing permissions, hooks, and MCP settings instead of replacing the entire file.

{
  "env": {
    "ANTHROPIC_AUTH_TOKEN": "YOUR_STEP_API_KEY",
    "ANTHROPIC_BASE_URL": "https://api.stepfun.ai/step_plan",
    "CLAUDE_CODE_MAX_CONTEXT_TOKENS": "1000000",
    "CLAUDE_CODE_AUTO_COMPACT_WINDOW": "1000000"
  },
  "model": "step-5-preview"
}

Claude Code may treat an unfamiliar model ID as a 200K model. Fully quit and restart it, then use /status to check the model, authentication source, and loaded config. Use /context to confirm a window close to 1M rather than 200K. StepFun notes that its setup script does not add the two context variables automatically.

Three practical pilot workloads

1. Compare clauses across contracts

Input: Ten to twenty de-identified contracts and a comparison schema. Flow: Extract clause locations first, then create a differences table and a missing-clause list. Review: Require every conclusion to point to the file, page, and source passage. A qualified person makes the legal judgment.

2. Propose a fix in a small repository

Input: A reproducible sample repository, a failing test, and read-only exploration tools. Flow: Separate the diagnosis, plan, patch, and test recommendation. Review: Inspect the diff scope, existing tests, new tests, and dependency changes. Do not enable automatic merge or deployment in the first pilot.

3. Investigate mixed image and video evidence

Input: Licensed images, a short sample video, and a question list. Flow: Separate observation from interpretation and attach time ranges or image numbers. Review: Reopen the original files and verify the key frames, numbers, and omitted intervals. Compression and frame sampling can hide important details.

Calculate cost, cache behavior, and throughput from evidence

The standard API pricing page lists Step 5 Preview at $1.00 per million cache-miss input tokens, $0.05 per million cache-hit input tokens, and $2.70 per million output tokens. StepFun says output billing includes reasoning tokens as well as the final answer. Repeatedly sending a large context can therefore dominate cost even when the visible response is short. Keep stable instructions and shared material at the beginning, with changing requests later in the prompt.

There is an important documentation mismatch. The model page and pricing table describe prompt caching for Step 5 Preview, while the separate prompt-caching guide lists only Step 3.7 Flash and Step 3.5 variants as supported. Until the pages converge, do not lock the cache discount into a budget. Inspect cached_tokens, account usage, and invoices from actual requests.

For the standard API, the V0 rate-limit table currently shows concurrency 5, 10 RPM, and 5M TPM. Limits can change by account and date, and Step Plan is not governed by the same table. Track P95 latency, retry count, and rate-limit errors, not just average response time.

Set data and permission boundaries

  • Keep API keys in environment variables or a secrets manager, never in browser-side code.
  • Review organizational approval and the applicable data-processing terms before sending customer data, regulated records, or private source code.
  • StepFun’s privacy policy says its servers are in the United States and describes collection of usage records and interaction data. It also states that some early-access programs may use prompts, outputs, and API logs for evaluation and improvement where law and program terms allow.
  • Grant least privilege to tools. Require separate approval and audit logs for deletion, external transmission, deployment, and other consequential actions.
  • Treat vendor demonstrations and benchmarks as test-plan inputs, not independent proof. Compare models with the same reproducible workload and review rubric.

Troubleshooting order

  1. 401 invalid_api_key: Check the key, environment-variable name, and selected billing channel.
  2. 404 or model does not exist: Check the base URL and account permission. Do not invent a different preview name.
  3. Claude Code shows 200K: Add both context variables as the plain string 1000000, then fully restart the client.
  4. No tool execution: Inspect the first response’s tool_calls, function name, JSON arguments, server result, and second model call in that order.
  5. Unexpected cost: Look for repeated conversation history, reasoning effort, output length, actual cache hits, and retries.
  6. Missed evidence in long files: Build an intermediate evidence table by file and section before requesting the final synthesis.

Adoption checklist

  • Did you record the model ID and the billing channel that actually handled the request?
  • Did the pilot start with public or de-identified data?
  • Are there pass criteria for accuracy, evidence, tool success, cost, and latency?
  • Are read and write permissions separated?
  • Are stop conditions and human approval points defined?
  • Did you compare the 1M-window workflow with a smaller-context alternative?
  • Did you verify cache support and discounts from actual usage?

The most useful part of Step 5 Preview is not the context number by itself. It is the option to combine a large evidence set with tools and multimodal inputs. Production quality, however, comes from the validation loop and permission design around the model. For a comparison with a managed agent runtime, see the OpenAI Agents API guide.

한국어판: Step 5 Preview 사용법: 1M 컨텍스트 에이전트 API를 안전하게 시험하는 법

Official sources

Sources checked September 21, 2026. Preview access, pricing, limits, and terms can change, so recheck the official pages before deployment.

Comments

Post a Comment

Popular posts from this blog

OpenAI Agents API: A Practical Guide to Managed Agent Runtimes

Image
Making one model call is different from operating an agent that reads files, uses tools, and works through several steps. The latter also needs progress records, execution permissions, recovery decisions, and a plan for keeping its outputs. The OpenAI Agents API exposes the Codex agent harness through an OpenAI-managed API. Its value is not simply a different model endpoint: it changes who operates part of the agent runtime. OpenAI announced the public beta on September 10, 2026. This guide explains what the service manages, how it differs from the Agents SDK and Responses API, and how to evaluate it with a small, reviewable task rather than immediately handing it an entire business process. Documentation checked: September 16, 2026. Three things to keep in mind A managed harness coordinates work and tool use; it is not the model itself. Choosing a managed runtime does not decide your data permissions, external-system access, or approval policy for you. Long-running work may benef...
Read more

Diagram Design: Set Up Claude Code or Codex for Clearer Diagrams

Image
Diagram Design is a third-party skill/plugin for coding agents that turns a written brief into an HTML file with inline SVG diagrams. It is not a standalone web-based diagram editor. Its useful promise is narrower: give an agent a specific process and visual direction, then review an editable browser-ready diagram rather than starting from a blank canvas. Three practical takeaways Use in-session slash commands for Claude Code and terminal CLI commands for Codex. Describe the flow, constraints, and output path before asking for drawing. Treat every generated diagram as a draft: verify logic, labels, privacy, and export needs yourself. What it does, and what it does not do The plugin can create several diagram layouts and produces static HTML by default. The inline SVG approach makes the result convenient to open, inspect, and share. Keep the request focused on the decision or process the reader must understand. Existing Mermaid, ...
Read more

Notion Agent Skills: Turn Repeatable Team Work into Reusable Instructions

Image
If your team repeatedly asks AI for the same meeting summary, review, or draft format, copying a prompt eventually becomes fragile. A useful prompt stays in one person’s notes, while the output varies from teammate to teammate. Notion 3.7 Agent Skills , released on September 15, 2026, are designed to turn that working knowledge into reusable instruction pages that Notion Agent can use again. This guide explains where Skills fit for a team that already uses Notion as its document and database hub, how they differ from Custom Agents, and what to check for permissions and cost. An example specification for a meeting-notes skill. Define the input and working rules before adding more instructions. What a Skill is: a repeatable way of working Notion defines a Skill as reusable instructions that teach Notion AI how to complete a type of work. The important detail is that a Skill is a Notion page , not an opaque configuration file. A team can name it, assign an owner, share it, revise it, ...
Read more