Subscription & CLI Sign-InNEW

Most providers in Sophon authenticate with a pay-per-token API key. But if you already pay for a flat-rate subscription — Claude Pro/Max, a ChatGPT plan, or GitHub Copilot — Sophon can authenticate against that plan instead. Usage is billed under your monthly subscription, and Sophon reports per-token cost as $0 so these models never count against a budget.

There are two ways Sophon obtains a subscription credential:

• CliSync — Sophon re-reads the access token saved by an external CLI's own credential store (for example, the credentials claude auth login writes). When the cached token nears expiry, Sophon re-reads it so the CLI's background refresh is picked up automatically.
• OAuth — Sophon runs the OAuth 2.1 + PKCE (or device) flow itself from the Dashboard, then persists and refreshes the tokens in its own encrypted credential store. No CLI required.

Subscription providers

These ids are providers like any other — add them from Settings → Models & Providers the same way you'd add an API-key provider. See Configuration for the general flow.

Three ways to use a Claude subscription

A Claude Pro/Max plan can back three different providers. All three rely on the Claude Code CLI being installed and signed in; they differ in what owns the request — and therefore in whether tool calling works and whether usage can spill into Anthropic's "extra usage" (overage) billing lane.

Rule of thumb: anthropic-subscription for non-tool chat with full streaming, claude-code for simple chat through the sanctioned CLI path, and claude-code-agent when you want tool-using agent turns on a plain subscription.

Anthropic via Claude Pro/Max (anthropic-subscription)

This provider does not take an API key. It reads the Claude Code CLI's stored credentials and calls api.anthropic.com directly as Claude Code, so the host must have the claude CLI installed and signed in via claude auth login. Sophon caches the access token and, when it nears expiry, re-reads it from the CLI store to pick up a refreshed token. If the credential is missing or expired, calls fail with a clear message to re-run claude auth login. Models routed this way support vision and streaming with a 200K context window — a great fit for non-tool chat.

Claude Code CLI (claude-code)

This provider shells the claude CLI in print mode (claude -p) and lets the CLI own the request — the sanctioned path for subscription use. Because the real CLI makes the call, usage draws from your normal subscription limits with no overage lane at all. The trade-off: it is text-only — no function calling and no token-by-token streaming — so Sophon's routing sends only non-tool turns to it and lets tool turns fall through to your other providers. Adding the provider requires the claude binary installed and signed in; you get a clear error otherwise.

Claude Code agent (claude-code-agent)

The tool-using answer for a plain subscription. This provider runs claude -p as its own agent loop and exposes it as an ordinary model provider, so it plugs into normal chat routing like any other model. Instead of Claude Code's built-in tools, the CLI is scoped to Sophon's tools over the embedded MCP server (--mcp-config pointed at the local /mcp/sse endpoint, authenticated with a short-lived bearer token) — so the agent can search memory, work with documents, and call anything else in your tool registry. Because the CLI owns the request, tool-using turns draw from normal subscription limits with no overage.

Every tool call the CLI makes still routes through Sophon's tool registry, so approval, risk, and sandbox gates apply exactly as they would for any other model.

Current v1 limits, stated plainly:

• Mid-loop approvals are auto-denied. claude -p is non-interactive, so a high-risk tool that would normally pause for your approval is denied (the safe default) instead of prompting. Pre-approved and low-risk tools run normally.
• Final-answer-only streaming. Per-tool-call events aren't surfaced while the loop runs; you get the completed answer.
• Flattened history. The conversation is flattened into a single prompt for each run.
• Single-user MCP token. The MCP token is bound to the default user; per-user scoping is a multi-tenant follow-up.
• Recent CLI required. The provider relies on newer claude CLI flags, so keep the CLI up to date.

OpenAI Codex via ChatGPT (openai-codex)

Codex talks to the ChatGPT backend using your subscription. You can connect in two ways: run the embedded OAuth login from the Dashboard (Sophon mints a PKCE challenge, you complete login in the browser and paste the code back), or let Sophon sync from the Codex CLI's ~/.codex/auth.json as a read-only fallback. Tokens obtained through the Dashboard are persisted to Sophon's encrypted store and refreshed automatically via the refresh-token grant. When a token can't be refreshed, re-authenticate from the Dashboard or run codex login.

GitHub Copilot (github-copilot)

Copilot uses a GitHub OAuth token, which Sophon exchanges for a short-lived Copilot API token. Authenticate with the GitHub device flow — Sophon shows a user code and verification URL, you approve it on GitHub, and Sophon polls until the token is issued. Alternatively, paste a personal access token; it's validated against GET /user before use. GitHub Enterprise Server hosts are supported by overriding the host. Your GitHub account must have an active Copilot subscription, or the token exchange fails. Copilot can route both Claude and GPT models.

Token lifecycle

Subscription tokens are short-lived and auto-refresh. Sophon checks validity before each request and transparently picks up new tokens — from the CLI store (CliSync) or via the refresh grant (OAuth). You only need to act when refresh is no longer possible, which usually means the underlying session expired:

• anthropic-subscription, claude-code, claude-code-agent: re-run claude auth login.
• openai-codex: reconnect in the Dashboard or run codex login.
• github-copilot: re-run the device flow or supply a fresh token.

Related

• Coding Agents — delegate tasks to the Claude Code, Codex, or Copilot CLIs, which reuse these same credentials.
• Supported Providers — the full catalog of cloud, local, and OpenAI-compatible providers.
• Configuration — how to add and prioritize any provider.