Connect AI access

What AI credentials are for

Codex and Claude Code have separate payment settings. Choose membership funding where included, connect a personal subscription, or configure an API key. Codex uses ChatGPT or OpenAI access; Claude Code uses Claude Pro/Max or Anthropic access. Connecting one provider does not connect the other.

A model credential pays for agent work. It does not grant access to other CoCalc projects, provision compute, or configure credentials for every script an agent runs.

Connect access for Codex

1. Open Codex or the AI settings area.
2. Choose Sign in with ChatGPT or configure an OpenAI API key.
3. Complete the device authorization or key setup flow.
4. Return to the Codex thread and start a concrete task.

If device authorization is running, keep the authorization panel visible until the browser confirms that the account is connected.

Choose the payment source for a thread

Connecting credentials makes them available. On hosted CoCalc, each thread can choose how its future turns are funded.

1. Open Codex settings using the Codex control. On phones, tap the button showing the model and reasoning level in the chat header.
2. Choose a payment source and click Save. ChatGPT Plan, Project OpenAI API key, and Account OpenAI API key appear when configured. CoCalc Membership is available only when the site and account provide an included allowance.
3. Check Payment source in Codex settings before submitting work.

Automatic prefers your ChatGPT plan, then the project API key, account API key, and membership allowance. You can continue an established session using ChatGPT or a personal API key without losing its context. Switching an established personal session to membership funding is disabled: start a new chat for the membership's constrained model profile. Returning from an explicit source to Automatic is also disabled after a session starts.

In Lite, configure a ChatGPT plan or an OpenAI API key in account AI settings; if both are configured, Lite uses the ChatGPT plan.

Check usage and recover a failed sign-in

Open account AI settings to inspect the connection. ChatGPT Codex usage appears when ChatGPT Plan is the resolved payment source. Click Refresh usage to request a live check. Meters show the percentage remaining and reset timing for each reported usage window; they are not a per-thread spending total. Missing or unchecked usage data does not mean the allowance is zero. The displayed account and plan help identify the connection. Hosted usage checks and device sign-in need an available project; open one when prompted and retry.

Connection not verified means a stored credential was found but the live check did not confirm access. Sign-in needs refresh means that connection needs attention before Codex can use it.

1. For an expired-authentication error, choose Sign in again, or update the OpenAI API key used by the thread.
2. Refresh usage or check the connection status again.
3. Return to the failed message and use Submit again when offered.

An allowance error is different from an expired sign-in. Follow its Open AI Settings or usage link and check the thread's selected payment source. Membership-funded access depends on the deployment and account; connecting a personal plan does not increase the membership allowance itself.

For unavailable-model messages, see Configure Codex chats.

Connect access for Claude Code

1. Open an agent and choose Claude in the runtime menu.
2. Open Claude settings using its settings icon or payment method control.
3. Choose CoCalc Membership if offered, a connected Claude Pro/Max subscription, an account Anthropic API key, or a project API-key secret.
4. For subscription access, choose Connect Claude Pro/Max and complete the sign-in flow. For a project key, use the Claude API-key dialog. Membership funding does not require your own Anthropic credential.
5. Check the selected payment method and available model before sending work. Changes apply to future turns, not work already admitted.

Membership-funded Claude uses its included model and the AI allowance shared with Codex; higher membership tiers include a larger allowance. A personal subscription uses that provider plan's allowance; API-key usage is billed by Anthropic. These modes have different credential and tool boundaries: see Claude Code access and billing. In particular, an account API key does not authorize agent-authored network or sensor turns, and a newly connected subscription does not load claude.ai account connectors. CoCalc project tools are separate from those connectors.

Use project secrets for keys

For code that calls a provider directly from a script, terminal, or notebook, store its API key as a project secret, such as OPENAI_API_KEY or ANTHROPIC_API_KEY. Project collaborators and project code can use these keys. An account subscription or isolated account-key relay is not a general API key for arbitrary project code. Do not paste keys into notebooks, chat messages, shell history, or committed files.

Complete a Codex authorization request

On sites that enable this workflow, a sensitive CoCalc CLI action can show Codex needs fresh account authorization in the chat, with the status Waiting for authorization.

1. Keep the originating CoCalc browser tab open and choose Approve in CoCalc on the card.
2. In the authorization page, check the account shown. Follow any instruction to sign in with that account.
3. Use an available verification method and choose Approve CLI Elevation. Complete password or second-factor verification on that page.
4. Return to the chat and inspect the result. The waiting integrated CLI command retries automatically after approval, so check its state before requesting another attempt.

Acknowledge and Snooze 5 minutes manage the notification; they do not authorize the action. An ordinary chat reply or question response also does not complete this verification. Keep passwords and verification codes out of chat.

If the request is canceled or expired, inspect the command's reported state before asking Codex to try again. This card is conditional on site support; it is not available for every command or deployment.

Why this matters in CoCalc

Keep the agent's payment method, project-code credentials, and CoCalc access permissions separate. Review the selected payment method before starting work, and configure only the credentials the project needs. A project secret is shared with project code and collaborators; an account connection has the provider-specific boundaries described in its guide.