Barge agents: API keys and subscriptions

A Barge session can use your own API key or a supported subscription connection. The choice depends on the coding agent you run. Connect the credential in your account’s Settings, then choose the agent and model.

Codex: API key or ChatGPT subscription

Codex runs on OpenAI. Barge supports two authentication paths:

• API key. Save your OpenAI API key in Settings. Barge passes it to the agent through the child process environment rather than writing it to a credential file.
• ChatGPT subscription. Connect a Codex-capable ChatGPT plan in Settings. Approve the device code in your browser. The worker writes the subscription’s auth.json with owner-only permissions (0600) in a private per-session directory, sets CODEX_HOME to that directory, and removes it during session cleanup.

In the agent settings, choose API key or ChatGPT subscription as the credential type. Each session records that choice. Selecting a subscription does not switch to an API key just because one is also saved. If the selected credential is missing, Barge reports it rather than silently using the other type.

The other harnesses

The harness is the CLI that drives the coding work. These four alternatives become available when you connect their credentials in Settings:

Harness	Provider	Credential
Claude Code	Anthropic	An Anthropic API key, or a token from claude setup-token
Grok Build	xAI	An xAI API key, or a connected SuperGrok / X Premium Plus subscription
OpenCode	OpenRouter	An OpenRouter API key
Devin CLI	Devin	The contents of credentials.toml from a local Devin CLI login

For Claude subscription authentication, run claude setup-token locally and paste the resulting token into the Claude plan connection in Settings. For Grok’s subscription path, use Connect and approve the device code in your browser.

For Devin, run devin auth login locally, then paste the contents of $XDG_DATA_HOME/devin/credentials.toml into Settings. The default path is ~/.local/share/devin/credentials.toml. Without a browser, use devin auth login --force-manual-token-flow. Barge imports the credentials file; Devin CLI has no device-code connection in the dashboard.

Build versus review defaults

Build, review, fix-review, and manual testing have separate agent settings. The platform factory defaults are Codex on OpenAI: gpt-5.6-luna at medium reasoning for build, and gpt-5.6-astra at low reasoning for each post-build stage.

For a personal account, a post-build stage without a saved override uses that session’s build configuration instead. Choosing a different build agent does not require a separate OpenAI credential just to run the later stages.

Choose the harness, model, and credential type for each stage in Settings. Those saved defaults take effect for new sessions without a control-plane restart. Existing sessions keep their recorded configuration.

Self-hosted deployment configuration

If you operate your own control plane, platform credentials can instead come from OPENAI_API_KEY, ANTHROPIC_API_KEY, XAI_API_KEY, or OPENROUTER_API_KEY. Platform agent defaults use BARGE_AGENT_*, including BARGE_AGENT_REVIEW_*, BARGE_AGENT_FIX_REVIEW_*, and BARGE_AGENT_MANUAL_* for the post-build stages.

Deployment environment values take precedence over saved platform settings. Changing the process environment requires a restart. These platform values do not replace a hosted user’s own credentials or personal agent defaults.

Guardrails

Rotating or deleting a credential does not rewrite an existing session’s configuration. It does invalidate that session’s next credential request, which fails with credential_rotated. A process already running may continue until it needs credentials again; review or a later resume can fail.

Do not rely on an automatic switch to Codex. For a personal account with an explicitly saved default, removing its credential leaves new sessions blocked until you reconnect it or change the default.

Provider-routing fallbacks are off by default (BARGE_AGENT_ALLOW_FALLBACKS=false). Enabling them is a separate routing choice, not a way to bypass credential revocation.

Provider billing and limits

API-key usage is billed by the selected provider. Subscription authentication uses the connected plan and remains subject to its usage limits. A connection in Barge does not establish that every plan permits hosted automation; check your provider’s current terms.

Those provider charges and limits are separate from Barge’s session infrastructure.

The next article is the practical one: getting started, from invitation to first handoff. Follow the series at the series index.

Barge is in private beta. Join the waitlist to get an invitation.