AI providers: API key or subscription

You use your own Anthropic API key or Claude subscription in Isolation by adding it as an AI credential on your account. Every AI credential is personal: the organization never holds one, never shares one and never pays for one. Seats are bought from the real providers, each member brings their own account, and Isolation only counts the tokens.

Two kinds of AI credential

An API key is a key you pay per token for. Anthropic and OpenAI are the common ones, and any OpenAI-shaped provider works too: Google, Groq, OpenRouter, Mistral, xAI, DeepSeek, Perplexity, Cerebras, Venice. A key can carry its own base URL when it belongs to a compatible proxy you run. An Anthropic key is probed when you save it, so a mistyped key fails at the Credentials page rather than in a session.

A subscription is a login, not a key. Claude Pro or Max and ChatGPT are both supported, and you never type a token: a device flow captures a refreshable login that stays inside Isolation. A subscription is pinned to its vendor's own endpoint; it cannot take a base URL, because an account-wide login is valid there and nowhere else.

Which harness you get

You pick a provider, never a harness. The harness is derived from the credential that pays:

An agent names the credential it uses by label; an agent that names none takes your oldest AI credential, so a member with one key gets working agents with no further setup. The same rule feeds the terminal: claude or codex in a terminal view is already signed in, with nothing pasted. See define an agent for how the label and model land on the roster.

How to add one

From the Credentials page, pick AI and either paste a key or choose Sign in. The same two paths are actions, so a CLI or an MCP client can do it:

credential_create        kind=ai  authKind=apiKey  provider=anthropic  label="Work key"  token=sk-ant-...
credential_login_start   provider=claude   → a URL to open; approve, paste the code once
credential_login_start   provider=codex    → a URL and a code to enter there; no paste at all
credential_login_complete provider=<claude|codex> handle=<from start>  [code=<claude only>]

Chat refuses credential_create for anything but an ssh public key, because a key typed into Slack or Teams stays in that channel's history. The login pair is safe from anywhere: no secret is ever typed. A completed login is the credential; two subscriptions at one vendor, a personal and a work Claude, are two rows with two labels, and one refreshing its token never touches the other.

What the gateway does

The key or login never enters the sandbox. At launch each agent, and the terminal itself, gets a scoped isogw_ gateway token bound to this session, with its own path prefix on Isolation's gateway (/anthropic/t/<agent> or /openai/t/session), so the egress sidecar can tell one token's traffic from another's. The sandbox sees only a placeholder and a base URL, as how secrets travel shows.

Per request, the gateway looks the token up by its hash, injects the real key, or for a subscription resolves the live access token and refreshes it before it expires, then forwards to the provider and streams the answer straight back. A subscription's token carries the vendor's OAuth beta flag for Claude and the account id for ChatGPT's Codex backend; a ChatGPT login also rides a relay so the backend sees an ordinary client.

The response body is teed once: one branch reaches the harness untouched, the other is read for the provider's own usage numbers. Input, output, cache-write and cache-read tokens land in a per-session read-out with the model, the agent and the credential that paid, at a cost of zero. That is the number cost, tokens and time rolls up per workspace and per member. Gateway tokens are revoked when the session ends and have a 30-day ceiling regardless.

Removing and replacing

credential_delete removes a credential; an agent that named it falls back to having none until you pick another. A key you rotate is edited in place on the Credentials page, and the stored value is never shown back, on any door. Git, ssh and custom credentials are a separate page: Git, SSH and custom credentials.