Every harness has two separate environments, and each one gets its own authentication setup:

Local - the harness runs on your machine, using your desktop app.
Cloud - the harness runs in a Proliferate cloud sandbox.

Switch between them with the segmented control at the top of a harness's settings page. Whatever you configure only applies to the environment you have selected; setting up Claude's gateway route for Cloud has no effect on what Claude does locally, and the other way around.

Harness settings page, surface toggle

The top of a harness settings page (e.g. Claude): the page title, a Cloud/Local segmented control on the right, and Authentication/All Models tabs below it.

Why they're separate

Local and cloud aren't just two places the same setup runs; they support different routes:

Native sign-in only makes sense locally. It relies on an interactive login or a credential file already on your machine. There's no terminal to log in from inside a cloud sandbox, so if a harness is left on native for Cloud, that harness simply can't run in the cloud until you turn on a gateway or API key route for it.
API keys and the gateway work on both. Once a key or the gateway is wired in, it works the same whether the harness is running locally or in a sandbox.

A common setup is: native sign-in locally (since you're already logged in to the CLI on your machine) and the Proliferate gateway for cloud runs (since there's nothing to sign in to inside a sandbox). Nothing stops you from using the gateway on both, or an API key on both, if that's simpler for your team.

Configuring each surface

Pick the harness and surface

Go to Settings -> Agents, open a harness, and use the Cloud/Local toggle to pick which environment you're configuring.

Set up Authentication

On the Authentication tab, turn on the gateway, add an API key row, or leave it native. This is exactly the same set of controls described in Gateway, BYOK & OAuth; the only difference is which surface you're looking at.

Check All Models

The All Models tab lists the models that harness can currently reach on the selected surface, with a toggle per model to hide ones you don't want showing up in the chat composer's picker.

Harness All Models tab

The All Models tab for a harness on the Local surface: a freshness line ('seed' or 'probed <time>'), a Refresh button, and a grid of models each with an enabled/disabled toggle.

Where the model list comes from

What "All Models" shows depends on the surface and route:

Local, gateway route. The list comes from your desktop runtime probing the gateway live with your credentials. It's either a seed list (a known-good default, before the first probe) or the result of a real probe, and the freshness line tells you which.
Any other combination. The list comes from Proliferate's model catalog for that harness, refreshed on demand.

Refresh doesn't happen automatically on a timer; use the Refresh button when you want the list re-checked, for example right after adding a new provider or expecting a new model to show up.

Model availability also depends on the route itself. A model your API key or gateway plan can't actually reach won't run even if it's toggled on here; enabling it in All Models only controls whether it's offered in the picker.

Per-harness × environment