Authentication

Every agent needs a way to reach a model provider. Configure that under Settings -> Agents: pick an agent, choose Local or Cloud in the Agents header, then select its authentication method.

Two surfaces, authenticated separately

Most agents have two surfaces, and each carries its own selection.

A common setup is native sign-in for Local and the gateway for Cloud.

Claude, Codex, and Grok choose exactly one of the three cards. OpenCode is the multi-provider exception: its CLI card stays selected, while the gateway and API-key cards can be turned on or off independently.

Route 1 — native sign-in

Native sign-in reuses credentials already available to the agent on your machine, including a subscription tied to that account. Model traffic goes from the agent to its provider rather than through Proliferate's model gateway.

Choose CLI login on Local. The detail panel reports whether credentials are authenticated, absent, or expired and has a refresh action. When credentials are missing or expired and the harness provides a login command, an Authenticate button opens that command in an embedded terminal. The button does not appear when the agent is already ready or when the harness does not provide a login command.

Route 2 — your own API key

Bring your own provider account by saving a key once and wiring it into the agents that need it. The agent calls the provider directly with this key; it does not use Proliferate's model gateway. Keys live in a titled vault and are shown only by title and redacted hint after you save them.

Select the API key card. With no key wired, its detail panel shows an empty state and Add API key. That action opens a modal for the key title, secret, and environment variable the harness reads, prefilled with the common value for that agent. Saving creates the vault entry and binds it in one step.

Each binding row shows its environment-variable name, a picker for saved vault keys, an enable switch, and remove and edit controls. The key picker can also create a new vault key inline.

OpenCode also offers Add provider, a search over the vendored provider list that prefills the provider's usual environment variable. A vault key cannot be revoked while an enabled binding still uses it.

Route 3 — Proliferate gateway

The gateway is Proliferate's managed path to models. Select its card and the agent reaches supported Anthropic, OpenAI, and xAI models without a provider key for you to manage. It works on both surfaces.

The gateway infrastructure retains the upstream provider credentials and issues your account a scoped virtual key with budget and usage tracking. The upstream provider credentials do not reach your machine or sandbox; the virtual key does, because the runtime needs it to call the gateway. Eligible new users may receive gateway credit to try it.

The gateway is available for Claude, Codex, Grok, and OpenCode. Cursor does not use it. The card is disabled if gateway access is unavailable, enrollment is pending or failed, or organization policy prevents a new gateway selection; the text below the card explains why.

Bring your own gateway

Running your own model gateway or inference endpoint is a self-hosted deployment task, not an organization setting inside the app.

How the routes work together

Organization policy can prevent members from moving to a disallowed harness or route, including native CLI login. It flags but does not rewrite an existing selection; a card that is already selected remains available so the member can move away from it.

Troubleshooting