Docs

Authentication

Every request needs your tenant slug in the URL path and your API key as a Bearer token — this part is identical for all four agents.

What's not identical is how each agent gets authenticated behind the scenes. That happens once per agent, per tenant, separately from your API key.

Codex & Grok — zero-touch

Both use a device-code sign-in (RFC 8628) that runs automatically as soon as your tenant is provisioned. You get a link, you approve it in your own browser against your own Codex/Grok account, and the resulting session stays scoped to your isolated tenant. We never see or store your password. If your tenant runs both, the two device-code steps happen one after another — nothing extra to configure on your end.

Claude Code — you supply a token

There's no device-code flow for Claude Code. Instead, you run this yourself, on your own machine, with your own Claude subscription:

That prints an OAuth token. Give it to us when we provision your tenant, and we store it only as the credential your tenant uses to authenticate — never shared, never logged in full.

Gemini CLI — one-time guided sign-in

Gemini CLI's personal Google OAuth doesn't have a device-code flow we can automate cleanly, so this one takes a short manual step: we walk you through a one-time guided sign-in and securely capture the resulting credential on your behalf. It's a one-time setup per tenant, not something you repeat per request.