Subscriptions and API channels

Codex, Claude, Antigravity and Grok Build subscription accounts support OAuth authorization and credential JSON import. Quota reporting covers Codex, Claude, Antigravity and Grok subscription periods. Previously stored accounts can be reauthorized, verified, enabled and assigned to workspace resource groups.

API channels

As a workspace administrator, open API channels → Add API channel. Creation has its own /channels/new page. Search the platform presets by name, platform ID or preset address; each platform has a local brand icon. A preset fills the base URL and upstream protocol. Choose Custom to configure Chat Completions, OpenAI Responses, Anthropic Messages or Gemini yourself. Protocol choices and network proxies are searchable too. Include the required API prefix, such as /v1 or /v1beta, without a generation endpoint, query parameters or credentials. Azure needs the base URL of your own resource. Local HTTP services are supported.

After saving, Verify connection, inspect Models, add the channel to a resource group, grant member access and create a personal gateway key. Discovery follows the configured protocol and platform: OpenAI-style lists, paginated Anthropic/Gemini catalogs, OpenCode inference catalogs and Qwen's dedicated model-list API are handled separately. Gemini discovery excludes models without generateContent. Native IDs such as openai/model keep their namespace.

Client formats are independent of the upstream protocol. The pinned SDK executors and public translators support regular and streaming responses while preserving explicit output limits and incomplete status. Tool and reasoning capabilities depend on the upstream and conversion path. /v1/responses/compact remains Codex-subscription-only. OpenCode requests receive a stable, member/group-scoped conversation ID; stateless model checks receive an independent ID. OpenCode free-tier and plan restrictions still apply.

Upstream keys and platform/protocol settings are encrypted. Keys are never returned in channel metadata and never enter OAuth refresh or the SDK credential store. Replace API key preserves the channel identity, platform, protocol, endpoint and existing conversation bindings; create another channel to change those settings. SubLane tracks requests and tokens but does not query API balances or subscription quotas. Synthetic tests do not establish live vendor acceptance.

The administrator endpoint is POST /api/channels, accepting name, api_key, base_url and optional proxy_id, platform and protocol. Protocol values are openai, responses, anthropic and gemini. Rotation uses PUT /api/channels/{id}/key; omitting platform/protocol preserves saved settings. Legacy channels retain Chat Completions behavior, with existing OpenCode endpoints recognized automatically. Subscription credential imports still reject API keys; API credential JSON uses provider: "openai".

Subscription quota

Subscription quota applies only to subscription accounts. API channel balances are not queried.

Grok reads the official Grok Build CLI billing metadata (GET https://cli-chat-proxy.grok.com/v1/billing?format=credits) and displays the included subscription percentage and its weekly or monthly reset period. Missing usage remains unknown. Legacy included credit totals are used only when the modern period is absent. On-demand spending, prepaid balances and product breakdowns are not treated as separate subscription allowances.

Claude reports its five-hour and weekly usage windows, including other named windows when supplied. Antigravity shows the remaining allowance and reset time for each visible model. The list initially shows three models, with constrained models first; expanding it shows every visible model. Internal-model quota observations are hidden from usage responses but retained in memory and SQLite for admission checks, including after restart. An exhausted internal model does not block unrelated models. Reset cards are shown only for Codex.

Queries read provider metadata without sending inference requests. Missing percentages or reset times stay unknown. Successful snapshots persist across restart; refresh failures retain the previous observation and mark it stale. Snapshots remain fresh for at most two minutes, shortened by an upcoming reset. Reporting does not certify model access or guarantee that a request will succeed. Fresh main quota windows gate Codex and Claude account selection. Antigravity gates only an exact match to the requested native model, including SDK thinking suffixes; an exhausted model does not exclude unrelated models or the entire account. Unknown, stale, future-dated and already-reset data does not imply exhaustion. Existing conversations keep their account binding when quota is exhausted.

Codex administrators can view reset cards, use the earliest-expiring eligible card, and enable scheduled or exhaustion-triggered use. These modes are optional and share a daily cap with manual use.

Connect a subscription

1. As a workspace administrator, open Subscription accounts → Add account, select the provider and enter a name.
2. Choose browser authorization or credential JSON import. For Codex, Claude and Antigravity browser authorization, sign in on the provider's page and paste the complete callback URL back into SubLane. For Grok, approve the displayed device code on the authorization page; SubLane completes the connection automatically.
3. Select Verify connection, then open Models to see the catalog reported by that account.
4. Add the account to a resource group, grant member access and create a personal gateway key.

SubLane does not run a local callback receiver, so a browser connection error at the callback address is expected. Copy the whole URL, including code and state. Authorization state is bound to the administrator session, single-use and valid for ten minutes. Codex and Claude use PKCE.

You can select a workspace network proxy before authorization or import. Token exchange, refresh, discovery and model execution use that account's server-side route; the browser sign-in page uses the browser's own network route.

Credential imports and refresh

Codex accepts nested token data or flat credential exports. Claude, Antigravity and Grok accept flat credential JSON exported by CLIProxyAPI, including access and refresh tokens and account identity. API-key credentials and imported endpoint or proxy overrides are rejected. SubLane does not scan local credentials automatically.

Grok imports use type: "xai" with OAuth access and refresh tokens, expired or expires_at, and identity from sub, id_token, account_id or email. Imported endpoints, using_api and API-key mode cannot switch subscription execution to metered API billing. Grok Build access depends on your subscription entitlement. Device attempts expire after at most ten minutes; cancellation or expiry prevents a late response from saving an account.

Reauthorization preserves the upstream account identity. Claude also retains one encrypted device identity across refresh, reauthorization and restart; legacy records acquire it before provider IO. Explicit credential failures require reauthorization, while temporary token failures use bounded retry backoff and respect upstream Retry-After.

Models and client protocols

Use a personal SubLane key to request GET /v1/models, then select an exact native model ID from that pool catalog. Catalogs include eligible Codex, Claude, Antigravity and Grok accounts. Grok uses the internal provider ID xai; use native model IDs from the catalog for client requests. Legacy provider-prefixed requests remain compatible. Existing conversations retain their account binding when accounts become disabled, busy or unavailable.

Client protocol and subscription provider are independent. OpenAI-compatible Responses and Chat Completions, Claude Messages and Gemini formats use the pinned SDK adapters to reach eligible accounts. Responses supports WebSocket; /v1/responses/compact is restricted to Codex accounts. Supported model features depend on the selected provider and conversion path.

Verification boundary

Automated tests use synthetic credentials and mocked upstreams. Enabling the integrations does not certify every real subscription or desktop-client workflow; perform separate acceptance checks for your accounts and clients. SubLane encrypts credentials and keeps them separate from member gateway keys. See the architecture.