Your subscriptions

If you already pay for Claude, ChatGPT, GitHub Copilot or a Google plan, AI Workbench can run your agents on it. Each subscription is used only by its own vendor's agent tool, talking to that vendor directly, and only for your work.

The rulesCopy Anchor Link

These hold whatever your settings say:

1. A subscription runs only its own vendor's tool. It is never used by another agent tool, a model provider, a custom endpoint or the workbench's model proxy.
2. The vendor's own tool signs in, as it is. The workbench never handles your password.
3. On a shared node, each person runs in their own profile. Your subscription serves only your runs, never the node's own sign-in and never another person's. There is no pooling and no rotation between accounts.
4. Reports never carry the secret. The workbench and your organisation see whether you are signed in, the plan, the account and when it expires, never the sign-in itself.

Sign in on this computerCopy Anchor Link

Subscriptions are signed in through each agent tool.

The card also says where else you are signed in, for example on a shared node.

Several accounts for one toolCopy Anchor Link

Claude Code, Codex and Google Antigravity can each hold more than one account: a work plan and a personal one, say.

1. In Settings → Models → Runtimes, under the tool's row, find Accounts and choose Add an account.
2. Give it a name, such as Work, and choose Add, then Sign in.
3. In a team member's or specialist's settings, choose which Account it runs on: Default sign-in or one you added.

A member that names an account this machine does not have cannot start here; add an account with the same name on this machine, or pick another.

On shared nodesCopy Anchor Link

When you are signed in to an organisation and your work runs on a shared node, your subscription is used there in your own profile, never shared with anyone else on the node.

If the node needs you to sign in, it starts the vendor's own sign-in under your profile and sends you the link and code through your organisation, as a request in your organisation's inbox and on your phone. Open the link, sign in, and send back what the page shows. See Approvals and the inbox.

A headless tokenCopy Anchor Link

For Claude and GitHub Copilot you can instead give your organisation a token it keeps sealed and hands only to your own runs of that tool, on machines that work on your projects, one run at a time. This is offered while you are signed in to an organisation. In Your subscriptions, choose Use a headless token:

• Claude: run claude setup-token in a terminal, sign in with your Claude account, and paste the token it prints.
• GitHub Copilot: make a GitHub token with Copilot access (a fine-grained token with the Copilot Requests permission) and paste it.

Choose Keep it. Manage in the console opens your settings in the organisation's console. Your organisation sees which subscriptions you have and on which machines, never the sign-in itself.

RelatedCopy Anchor Link

• Runtimes and agents
• Sandboxing: what happens to your sign-in inside a sandbox.