Keys

Agents call the model with your provider key or, where it is offered, with KeepState’s key, chosen per session and paid from credit you have bought; the pricing page says whether it is offered today. Your key is stored by the service and never placed inside a session’s machine; the machine gets a per-session credential, and the gateway resolves your key when a call leaves.

Add a key

In a terminal, outside the app:

ks key add --provider anthropic --alias work

The key is read from standard input, never from an argument, so it does not reach your shell history (ks key add --provider anthropic < key.txt works too). A / command inside the app gets no standard input, so this one runs in a terminal, or add the key in the console. The key never comes back out: after this, the client and the console show its id and its last four characters only.

You hold one key per provider. Adding a key for a provider you already hold replaces the secret in place: the key keeps its id, and its alias unless you give a new --alias, so bindings to it keep working, and a disabled key is enabled again. The providers are anthropic, openai and openrouter; an agent session needs an enabled key for the provider its runner calls: Anthropic for Claude Code, OpenAI for Codex CLI (runners).

Manage keys

In the app: /keys, /key show <key>, /key disable <key>, /key enable <key> and /key delete <key> --yes. From a terminal:

ks key list
ks key show <key>
ks key disable <key>
ks key enable <key>
ks key delete <key>

• A disabled key admits no new calls; calls already in flight are reconciled.
• A deletion first shows its plan, including the session bindings it drops, and is carried out with --yes. A session left without a key is refused at its next call until you bind one again.
• A key is named by its id or its alias.

Bind a key to a session

Every agent session is bound to one key per provider, and a bound key is used or nothing is: a call is never sent on another key.

• ks run --agent (and n in the app) binds the key when it creates the session: the one --key names, or your enabled key for the runner’s provider (Anthropic, or OpenAI with --harness codex). Without one it refuses before anything is created.
• A switch of the session’s runner to Codex CLI binds your enabled OpenAI key if the session lacks one, and fails without one (switching).
• Change the binding later with /session key set --key <key> in the agent’s window, or ks session key set <session> --key <key>.

A session without a key for the provider its agent calls is refused by the gateway at its first call (“this session is not bound to a key for that provider; nothing was billed”), and the refused instruction holds the agent’s queue. Bind a key, continue the queue with /agent queue resume --finding "key bound", and send the instruction again.

Cruise and keys

When you approve a Cruise job, ks cruise approve binds your key for each provider on its model ladder into the approval.