Subscription & CLI Sign-InNEW

Most providers in Sophon authenticate with a pay-per-token API key. But if you already pay for a flat-rate subscription — Claude Pro/Max, a ChatGPT plan, or GitHub Copilot — Sophon can authenticate against that plan instead. Usage is billed under your monthly subscription, and Sophon reports per-token cost as $0 so these models never count against a budget.

There are two ways Sophon obtains a subscription credential:

• CliSync — Sophon re-reads the access token saved by an external CLI's own credential store (for example, the credentials claude auth login writes). When the cached token nears expiry, Sophon re-reads it so the CLI's background refresh is picked up automatically.
• OAuth — Sophon runs the OAuth 2.1 + PKCE (or device) flow itself from the Dashboard, then persists and refreshes the tokens in its own encrypted credential store. No CLI required.

Subscription providers

These ids are providers like any other — add them from Settings → Models & Providers the same way you'd add an API-key provider. See Configuration for the general flow.

Anthropic via Claude Pro/Max (anthropic-subscription)

This provider does not take an API key. It reads the Claude Code CLI's stored credentials, so the host must have the claude CLI installed and signed in via claude auth login. Sophon caches the access token and, when it nears expiry, re-reads it from the CLI store to pick up a refreshed token. If the credential is missing or expired, calls fail with a clear message to re-run claude auth login. Claude models routed this way support vision, tool calling, streaming, and a 200K context window.

OpenAI Codex via ChatGPT (openai-codex)

Codex talks to the ChatGPT backend using your subscription. You can connect in two ways: run the embedded OAuth login from the Dashboard (Sophon mints a PKCE challenge, you complete login in the browser and paste the code back), or let Sophon sync from the Codex CLI's ~/.codex/auth.json as a read-only fallback. Tokens obtained through the Dashboard are persisted to Sophon's encrypted store and refreshed automatically via the refresh-token grant. When a token can't be refreshed, re-authenticate from the Dashboard or run codex login.

GitHub Copilot (github-copilot)

Copilot uses a GitHub OAuth token, which Sophon exchanges for a short-lived Copilot API token. Authenticate with the GitHub device flow — Sophon shows a user code and verification URL, you approve it on GitHub, and Sophon polls until the token is issued. Alternatively, paste a personal access token; it's validated against GET /user before use. GitHub Enterprise Server hosts are supported by overriding the host. Your GitHub account must have an active Copilot subscription, or the token exchange fails. Copilot can route both Claude and GPT models.

Token lifecycle

Subscription tokens are short-lived and auto-refresh. Sophon checks validity before each request and transparently picks up new tokens — from the CLI store (CliSync) or via the refresh grant (OAuth). You only need to act when refresh is no longer possible, which usually means the underlying session expired:

• anthropic-subscription: re-run claude auth login.
• openai-codex: reconnect in the Dashboard or run codex login.
• github-copilot: re-run the device flow or supply a fresh token.

Related

• Coding Agents — delegate tasks to the Claude Code, Codex, or Copilot CLIs, which reuse these same credentials.
• Supported Providers — the full catalog of cloud, local, and OpenAI-compatible providers.
• Configuration — how to add and prioritize any provider.