Keys and models

Estelle uses two different kinds of credential:

• An Estelle API key authenticates your CLI, MCP client, hooks or scripts to your Estelle account.
• A provider key is a credential for a model provider you already pay. It can serve selected Estelle surfaces or enable a coding agent in a Silo.

They are not interchangeable. Keep both out of source control and support messages.

#Create an Estelle API key

Create a separate key for each machine or integration so you can revoke one without interrupting the others.

1. Create the key

   Open Settings → API keys. Enter a label such as laptop or ci, then choose Create key.

2. Copy it immediately

   The full key is shown once. Estelle stores only a hash, so it cannot show the key again.

3. Connect your tool

   Run estelle login and paste the key when asked:

   bash

   estelle login

   For an environment variable, set ESTELLE_API_KEY. For the API or an MCP client that uses bearer authentication, send:

   text

   Authorization: Bearer estelle_live_...

The key list shows the prefix, label, creation date and whether the key is active. Rename changes its label; Revoke disables it. Keys that agent workspaces create for themselves appear as a count and are revoked automatically.

#Rotate or remove a key

If a key is exposed or no longer needed:

1. Create a replacement and update the tool that used the old key.
2. Check that the tool works with the replacement.
3. Choose Revoke on the old key.

When an owner's existing workspace becomes a team's workspace, the original primary key is retired. Use the replacement shown during that flow, or create a new key. See Teams.

#Choose what a provider key serves

Estelle's own inference is the default. Adding a provider key does not move every surface automatically: you choose its uses.

1. Add the credential

   Open Settings → Provider keys and choose Add a key. Select the provider, paste the key and optionally give it a name your team will recognize. If the provider asks for an endpoint URL, enter that too.

2. Select its uses

   Under Use this key for, choose any of the offered surfaces:

   • Estelle inference (Ask, agents, Atlas)
   • Prism code review
   • Automations
   • Claude Code, Codex or Kimi CLI in Silos, when that provider supports one of those agents

   Everything left unticked continues on Estelle's own inference. There is one provider key per provider in the workspace.

3. Test and review the result

   Choose Test key. The result says whether the provider accepted the key, refused it, or could not be confirmed. Then check the serving list to see which key serves each surface.

Use Uses on an existing key to change these selections. Rename changes only its display name. Remove requires confirmation and removes the credential from Estelle.

On a team, provider keys belong to the shared workspace. Only a team admin can add, change or remove them.

#Use a Claude subscription in Silos

To run Claude Code with your own Claude subscription:

1. On your own machine, run claude setup-token and complete the browser sign-in.
2. Copy the token it prints. It is shown once.
3. In Settings → Provider keys, add the Claude subscription token rather than an Anthropic API key.
4. Choose Test token to check it with Anthropic.

This token serves Claude Code in Silos. It is not used for Estelle's own inference.

For a provider key that enables a coding agent, Uses can also offer a model choice and a per-run spend cap on that key. A launch or automation can set its own cap.

#Use a model in your terminal or editor

An editor connected through MCP still chooses its own model; an Estelle API key does not change that choice.

In the Estelle terminal, use /login to connect a model account and /model to choose one. From your shell, use estelle login --provider <name>. See CLI for provider names and custom OpenAI-compatible endpoints.

#How credentials are handled

• Estelle API keys are stored as hashes and shown in full only when created.
• Provider keys and subscription tokens are stored encrypted. The dashboard and account reads never return the stored secret, not even a partial value.
• Test key and Test token make a small provider request on that credential, so the provider may bill the test.
• Calls served by your provider are subject to your provider's terms and billing.

#Related