Bring your Claude or Codex subscription
Point an environment at a plan you already pay for — no API key, and the token never enters the workload.
WhereConsoleCLI
Introduced Aug 7, 2026
claude · stock config→gateway attaches your plan's token→api.anthropic.com
✓ token never in the container✓ calls traced & counted
How it works
Attach a plan, not a key.
A subscription is a vendor plus a secret — point an environment at it and the agent CLI runs in its stock configuration.
Intercepted at the gateway.
The platform attaches the real credential after the request leaves the workload. A shell in the sandbox cannot read the token, and revoking it takes effect without restarting anything.
Still governed.
The traffic is traced, counted, and subject to your model allowlist — the platform is on the path, not beside it.
The fine print, stated.
Anthropic's terms cover a subscription for a person in a sandbox, not for an autonomous agent; Codex plans carry no such line. Said where the choice is offered, not hidden.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.