# Keys and models

> Create and revoke Estelle API keys, choose the model provider keys each product surface uses, and connect coding agents in Silos.

Estelle uses two different kinds of credential:

- An **Estelle API key** authenticates your CLI, MCP client, hooks or scripts to your Estelle account.
- A **provider key** is a credential for a model provider you already pay. It can serve selected Estelle surfaces or enable a coding agent in a Silo.

They are not interchangeable. Keep both out of source control and support messages.

## Create an Estelle API key

Create a separate key for each machine or integration so you can revoke one without interrupting the others.

### Create the key

Open **Settings → API keys**. Enter a label such as `laptop` or `ci`, then choose **Create key**.

### Copy it immediately

The full key is shown once. Estelle stores only a hash, so it cannot show the key again.

### Connect your tool

Run `estelle login` and paste the key when asked:

```bash
estelle login
```

For an environment variable, set `ESTELLE_API_KEY`. For the API or an MCP client that uses bearer authentication, send:

```text
Authorization: Bearer estelle_live_...
```

The key list shows the prefix, label, creation date and whether the key is active. **Rename** changes its label; **Revoke** disables it. Keys that agent workspaces create for themselves appear as a count and are revoked automatically.

## Rotate or remove a key

If a key is exposed or no longer needed:

1. Create a replacement and update the tool that used the old key.
2. Check that the tool works with the replacement.
3. Choose **Revoke** on the old key.

When an owner's existing workspace becomes a team's workspace, the original primary key is retired. Use the replacement shown during that flow, or create a new key. See [Teams](https://docs.fatelabs.ca/teams).

## Choose what a provider key serves

Estelle's own inference is the default. Adding a provider key does not move every surface automatically: you choose its uses.

### Add the credential

Open **Settings → Provider keys** and choose **Add a key**. Select the provider, paste the key and optionally give it a name your team will recognize. If the provider asks for an endpoint URL, enter that too.

### Select its uses

Under **Use this key for**, choose any of the offered surfaces:

- **Estelle inference (Ask, agents, Atlas)**
- **Prism code review**
- **Automations**
- **Claude Code, Codex or Kimi CLI in Silos**, when that provider supports one of those agents

Everything left unticked continues on Estelle's own inference. There is one provider key per provider in the workspace.

### Test and review the result

Choose **Test key**. The result says whether the provider accepted the key, refused it, or could not be confirmed. Then check the serving list to see which key serves each surface.

Use **Uses** on an existing key to change these selections. **Rename** changes only its display name. **Remove** requires confirmation and removes the credential from Estelle.

On a team, provider keys belong to the shared workspace. Only a team admin can add, change or remove them.

## Use a Claude subscription in Silos

To run Claude Code with your own Claude subscription:

1. On your own machine, run `claude setup-token` and complete the browser sign-in.
2. Copy the token it prints. It is shown once.
3. In **Settings → Provider keys**, add the **Claude subscription token** rather than an Anthropic API key.
4. Choose **Test token** to check it with Anthropic.

This token serves Claude Code in Silos. It is not used for Estelle's own inference.

For a provider key that enables a coding agent, **Uses** can also offer a model choice and a per-run spend cap on that key. A launch or automation can set its own cap.

## Use a model in your terminal or editor

An editor connected through MCP still chooses its own model; an Estelle API key does not change that choice.

In the Estelle terminal, use `/login` to connect a model account and `/model` to choose one. From your shell, use `estelle login --provider <name>`. See [CLI](https://docs.fatelabs.ca/cli) for provider names and custom OpenAI-compatible endpoints.

## How credentials are handled

- Estelle API keys are stored as hashes and shown in full only when created.
- Provider keys and subscription tokens are stored encrypted. The dashboard and account reads never return the stored secret, not even a partial value.
- **Test key** and **Test token** make a small provider request on that credential, so the provider may bill the test.
- Calls served by your provider are subject to your provider's terms and billing.

## Related

- [Plans and credits](https://docs.fatelabs.ca/plans): Understand which work uses your plan and which uses your provider.
- [MCP server](https://docs.fatelabs.ca/mcp): Use an Estelle API key or OAuth in an MCP client.
- [API](https://docs.fatelabs.ca/api): Authenticate OpenAI-compatible API calls.