Platform keys

Platform keys are instance-wide credentials an administrator connects in the browser — during first-run setup or later in Settings → Integrations and Settings → Models. No terminal or configuration file is needed.

Every key is checked with its provider before it is saved, stored encrypted (AES-256-GCM) and never shown again: the UI and API only report whether a key is set and its last four characters.

| Key | Needed for | Without it | |---|---|---| | Model provider | Every agent’s thinking | Agents cannot run until they have a model credential of their own | | GitHub | Private repositories, pushing agent work | Public templates only, no push | | Email (Resend) | Sending sign-in codes from your own domain | See below | | Gemini | Voice, voice-note transcription, generated avatars, Gemini CLI agents | No voice, no generated avatars |

Model providers

Settings → Models is the single place to connect model providers for the whole instance — Anthropic, OpenAI, Google, OpenAI-compatible endpoints and others. A provider connects with an API key or, where the vendor offers it, an account sign-in (Claude, ChatGPT or Google account). Several accounts of the same provider can be connected.

Enabled models are published as <connection>/<model> and become selectable everywhere a model is picked — agent creation, chat, tasks, loops and schedules — on every runtime. Teams can be restricted to an allowlist with a budget; see Model gateway & budgets.

Claude credentials

For Claude Code agents, connect either:

• a Claude subscription token (Pro or Max) — run claude setup-token where Claude Code is signed in and paste the sk-ant-oat01-… token; or
• an Anthropic API key (sk-ant-api…) for pay-as-you-go billing.

Several subscription tokens can be registered and assigned to agents automatically, with usage and headroom shown per subscription. Subscription use is subject to the provider’s terms.

How model costs are billed

Bring your own Anthropic, OpenAI or Google keys and pay the provider directly with no markup, or use the managed model gateway billed at provider list price plus 5%.

On ExoHuman Cloud, model usage is separate from compute billing — see Billing.

GitHub

A GitHub personal access token lets agents clone private repositories and push their work. Use a classic token with the repo scope, or a fine-grained token with Contents: read and write on the repositories you need.

Which token an agent uses, in order of precedence:

1. a per-agent token set in the agent’s Settings → Storage → GitHub authentication;
2. the creator’s personal GitHub credential (Settings → My account → My GitHub connection);
3. the instance-wide token from Settings → Integrations → Shared GitHub connection.

Prefer per-agent or personal tokens so agents act with the narrowest access. Saving the instance token updates running agents that use it.

Email

In Settings → Integrations → Email delivery: ExoHuman signs people in with one-time email codes — you, your team and anyone you share an agent with. Connect a Resend API key and a Send codes from address on a domain verified in Resend to send codes from your own domain. The check refuses addresses whose domain Resend has not verified.

Gemini

A Google Gemini API key powers voice conversations, Telegram voice-note transcription, phone calls and generated agent avatars, and is given to agents on the Gemini CLI runtime. Adding it later switches voice on without a restart.

API

All endpoints are admin-only and never return a key.

| Endpoint | Purpose | |---|---| | GET /api/settings/api-keys | Status of anthropic, github, resend, gemini | | POST /api/settings/api-keys/{key}/test | Check a key with its provider without saving | | PUT /api/settings/api-keys/{key} | Save a key | | DELETE /api/settings/api-keys/{key} | Remove a key | | POST /api/subscriptions | Register a Claude subscription token |