Model credentials that follow the person

A developer works in two organizations. She keeps two Claude subscription logins and an Anthropic API key, and she saved all three in each organization, because a key saved in one did nothing for a run in the other. Three hours into a refactor on her laptop, the login in use hits its usage limit. The run stops. She swaps logins by hand, starts the run again, and rebuilds the context the agent had.

With Oxagen 5.5.0 she saves each credential once. The run moves to her next login before the harness sees the refusal.

#How model credentials belong to a person

A model credential is an API key or a subscription login that pays for an agent's model calls. Oxagen used to file each one under an organization. A person in two organizations saved every key twice, and the limit of 50 credentials counted each organization apart.

A credential now belongs to the person who saved it. One saved key or login serves their runs in every organization they work in. The Credentials tab and oxagen credentials list show the same list everywhere. A pause or a removal holds in every organization, and so does a usage limit a provider reports on one organization's run.

Every read filters on the person, and the code checks the owner a second time before it lists or attaches a row. Removing a person from an organization leaves their credentials alone, because the credentials were never the organization's. Their runs there stop because their membership and their run tokens end.

#How a team shares one model account

A team that buys one Claude or OpenAI account for its agents had nowhere to put it.

A workspace account is a credential the workspace holds. The workspace's Admins and the organization's Owners add and change it, and every member can see the list. Each agent's profile names where its sandbox runs take model accounts: the operator's own, the workspace's, or the operator's first and then the workspace's. A send records that choice on its work order. An edit to the profile between the send and the launch cannot change who pays.

This applies to sandbox runs, whose model calls pass through Oxagen's cloud gateway. A send to an agent on a person's own machine records no account source. The harness there uses the person's own logins, as the next section describes.

#How runs switch accounts at a rate limit

Providers count usage per account. Anthropic sets rate limits at the organization level and answers a request over them with a 429 that may carry a retry-after header.¹ A 429 alone says little. OpenAI answers 429 for a request rate that rose too fast, for an organization with no prepaid credits left, and for a spend limit reached, each with its own code.² A gateway that only reads the status cannot tell a pause of seconds from an account that is done for the month.

On a person's own machine, the harness sends its model calls to a local proxy in the Oxagen recorder. The proxy now holds a pool for each harness it brokers. It fetches the person's saved credentials from Oxagen when the recorder starts, at enrollment, and every 15 minutes after.

When a call on a pool of two or more comes back refused, the proxy reads the provider's answer before it writes a byte to the harness. It sorts the refusal into a usage limit with its reset time, a token the provider no longer accepts, or an account the provider shut. Then it marks that credential and sends the same request on the next one. While a credential is left, the harness sees none of this. When every credential has failed, the harness reads one error, credentials_exhausted, that names each credential by its last four characters, whether it is a login or a key, and what the provider answered.

Sandbox runs rotate in the cloud gateway the same way, and it now moves past a dead token or a shut account as well as a usage limit.

This has a cost a security reviewer will ask about. Copies of a person's saved credentials now travel to each machine they enrolled, encrypted on that machine. The sync sends only that person's credentials, and only for a harness the machine already brokers. It never sends one to a sandbox, never hands one to the harness, and never sends one to a company gateway the harness was pointed at, because that gateway would read the person's keys. Unenrolling the machine erases the copies. Two machines that share one ChatGPT login can still lose it. That login refreshes its tokens, and each refresh token works once. The OAuth security guidance recommends exactly that rotation, so the provider can spot a token that two clients used.³ The second machine holds the login back for an hour and the person saves it again. Cursor is not covered, because its model calls do not pass through Oxagen.

#How to repair an expired login

At 9 PM a Claude Code login expires. The gateway marks it, the sandbox runs that used it wait, and the Console shows the account. Before this release, fixing it meant running claude setup-token somewhere, pasting the token into a new credential, and removing the old one. The new credential started with a new ID, at the end of the order, and the waiting runs did not point at it.

Now Reauthenticate account on the Console card sends a sign-in request to the person's own most recently seen enrolled machine in that workspace. On that machine the person runs oxagen credentials reauth. The command names the account and asks first. It runs the harness's own login, claude setup-token or codex login, and reads the token without printing it. The machine's device key, which never leaves the machine, locks each answer, so a copy of the person's CLI session on another machine cannot answer the request.

Oxagen checks the new login before it saves anything. It then replaces the secret in place, and only while the credential still holds the secret it held when the request started. Oxagen compares a hash of each secret, a short code made from it that changes when any character does. The credential keeps its ID, its place in the order, and its usage limits, and the runs that waited continue. A request expires after 15 minutes. A ChatGPT login for a different account waits for the person's yes.

The limits are plain. This flow has not yet run end to end against a live provider login. A Claude setup token names no account Oxagen can read, so a Claude login for a different account replaces the saved one without a question. A person with no enrolled machine that can take the request gets the account's settings instead.

#How each device picks its workspace

The same laptop can run Claude Code for one organization and Codex for another. Before this release, oxagen workspace use changed the CLI's default and nothing else. The laptop kept taking work from the old workspace, and a laptop asleep since yesterday still got sends.

Now oxagen workspace use picks the one workspace that sends work to the machine.⁴ The machine's agents in every other workspace go on standby. A send they had not started ends with a reason, so its work item can be sent again. Each enrollment in the new workspace takes a new connection number, and Oxagen refuses a send stamped with an older one at delivery, at the claim, and on the machine. A machine that has not checked in within five minutes takes no send. Runs already going keep reporting to their own workspace.

The switch changes which workspace sends work. It does not move where a new session started by hand reports, and it runs from the CLI only.

#What the record keeps about credentials

A rotation is written on the call's frame with each credential's ID and failure, and no secret. The steps to save, rotate, and repair a credential are in the sandbox guide.⁵ The full list of changes is in the Oxagen 5.5.0 release post.