Authentication
How each agent reaches a model — native sign-in, your own API key, or the Proliferate gateway.
Every agent needs a way to reach a model provider. Pick one under Settings → Agents.
Cloud workspaces and their separate authentication surface are coming soon. This page describes authentication for agents running on your machine.
Claude, Codex, and Grok pick one of three cards: Proliferate gateway, API key, or CLI login. Cursor has no gateway card. OpenCode is the exception — instead of cards it has a Providers section where several keys apply at once.
Route 1 — native sign-in
Native sign-in reuses credentials the agent already has on your machine, including a subscription on that account. Traffic goes straight from the agent to its provider.
Choose CLI login. The badge in the header says whether credentials are authenticated, absent, or expired. If they are missing and the harness has a login command, an Authenticate button opens it in an embedded terminal.
| Agent | Native sign-in |
|---|---|
| Claude Code | Runs claude /login when needed, or uses a cached credential. |
| Codex | Runs codex login when needed, or uses a cached credential. |
| Grok | Runs grok login when needed, or uses a cached Grok credential. |
| OpenCode | Uses provider authentication from opencode auth login alongside any keys you add. |
| Cursor | Runs cursor-agent login when needed, or uses a cached credential. |
Route 2 — your own API key
Save a key once and wire it into the agents that need it. The agent calls the provider directly; the gateway is not involved. Keys live in a vault and are shown only by title and redacted hint after you save them.
Select the API key card. Paste key saves the secret and binds it in one
step, titling the vault entry by provider. Saved keys binds one you already
have. Either way Proliferate derives the variable the agent reads —
ANTHROPIC_API_KEY for Claude, OPENAI_API_KEY for Codex — so there is nothing
to name by hand.
Removing a bound key unbinds it from the agent without deleting the vault entry.
OpenCode manages keys from its Providers section instead. A vault key cannot be revoked while an enabled binding still uses it.
Claude and Codex show an AWS Bedrock tab, but its save flow is not wired up, so Bedrock is not a supported route yet. Azure is pending too.
Route 3 — Proliferate gateway
The gateway is Proliferate's managed path to models. Select its card and the agent reaches supported Anthropic, OpenAI, and xAI models with no provider key to manage.
The gateway holds the upstream provider credentials and issues your account a scoped virtual key with budget and usage tracking. Only that virtual key reaches your machine. Eligible new users get gateway credit to try it.
The gateway works with Claude, Codex, and Grok. Cursor and OpenCode do not offer it. A disabled card explains why underneath: gateway unavailable, enrollment pending or failed, or organization policy.
Bring your own gateway
Running your own gateway or inference endpoint is a self-hosted deployment task, not a setting in the app.
How the routes work together
| Agent | Behavior |
|---|---|
| Claude, Codex, Grok | One card at a time. Selecting the gateway disables the bound key; selecting an API key disables the gateway. CLI login is the native route. |
| OpenCode | A Providers section instead of cards. Keys you add there apply alongside OpenCode's own CLI logins; there is no gateway control. |
| Cursor | API key or its own CLI login. There is no gateway card. |
Organization policy can stop members from moving to a disallowed harness or route, CLI login included. It flags an existing selection but never rewrites it, so a member can always move away from what they already have.