Authentication

Every agent needs a way to reach a model provider. Configure that under Settings -> Agents: pick an agent, then select its authentication method.

Claude, Codex, and Grok choose exactly one of three cards: Proliferate gateway, API key, or CLI login. Cursor has no gateway card and chooses between API key and CLI login. OpenCode is the multi-provider exception: instead of method cards, its page has a Providers section where several keys apply at once alongside OpenCode's own logins.

Route 1 — native sign-in

Native sign-in reuses credentials already available to the agent on your machine, including a subscription tied to that account. Model traffic goes from the agent to its provider rather than through Proliferate's model gateway.

Choose CLI login. The badge in the section header reports whether credentials are authenticated, absent, or expired and has a refresh action. When credentials are missing or expired and the harness provides a login command, an Authenticate button opens that command in an embedded terminal. The button does not appear when the agent is already ready or when the harness does not provide a login command.

Route 2 — your own API key

Bring your own provider account by saving a key once and wiring it into the agents that need it. The agent calls the provider directly with this key; it does not use Proliferate's model gateway. Keys live in a titled vault and are shown only by title and redacted hint after you save them.

Select the API key card. With no key bound, its detail panel offers two paths. Paste key takes the secret alone: saving creates the vault entry, titled by provider (for example "Anthropic API key"), and binds it in one step. Saved keys lists the active keys already in your vault so you can bind one directly. Either way, Proliferate derives the environment variable the agent reads from the agent itself — ANTHROPIC_API_KEY for Claude, OPENAI_API_KEY for Codex, and so on — so there is nothing to name by hand.

Once a key is bound, the panel shows just that key's title and redacted hint, with a remove control that unbinds it from the agent without deleting the vault entry.

OpenCode manages keys from its Providers section instead. A vault key cannot be revoked while an enabled binding still uses it.

Route 3 — Proliferate gateway

The gateway is Proliferate's managed path to models. Select its card and the agent reaches supported Anthropic, OpenAI, and xAI models without a provider key for you to manage.

The gateway infrastructure retains the upstream provider credentials and issues your account a scoped virtual key with budget and usage tracking. The upstream provider credentials do not reach your machine; the virtual key does, because the runtime needs it to call the gateway. Eligible new users may receive gateway credit to try it.

The gateway is available for Claude, Codex, and Grok. Cursor and OpenCode do not offer it. The card is disabled if gateway access is unavailable, enrollment is pending or failed, or organization policy prevents a new gateway selection; the text below the card explains why.

Bring your own gateway

Running your own model gateway or inference endpoint is a self-hosted deployment task, not an organization setting inside the app.

How the routes work together

Organization policy can prevent members from moving to a disallowed harness or route, including native CLI login. It flags but does not rewrite an existing selection; a card that is already selected remains available so the member can move away from it.

Troubleshooting