Your own keys in Paperclip
Paperclip never proxies model traffic itself. Each agent run spawns a vendor CLI (Claude Code, Codex, or OpenCode), and that CLI authenticates with whatever keys it finds in its environment. Bringing your own key is therefore an environment change, not a code change: set the right variables on the agent, and the CLI talks to your provider directly. The machine has open egress to public AI APIs, so no network setup is needed.
Where keys go
Section titled “Where keys go”Open the agent’s configuration in the Paperclip web UI and find the Environment variables editor. Each entry is either a plain value or a reference to a company secret. Secrets are the better home for API keys: they are encrypted at rest in Paperclip’s database, resolved only when a run starts, versioned, and every access is audit-logged. Manage them under Settings → Secrets, or create one inline from the environment editor.
Variables you set on an agent override the same variables from the host environment, so agent-level keys always win.
Claude Code agents
Section titled “Claude Code agents”On Harnesser, Claude Code agents are pre-wired to the built-in model gateway through two host variables: ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN. To use your own Anthropic key instead, override all of the gateway wiring on the agent:
| Variable | Value |
|---|---|
ANTHROPIC_API_KEY |
your Anthropic API key (as a secret reference) |
ANTHROPIC_BASE_URL |
https://api.anthropic.com |
ANTHROPIC_AUTH_TOKEN |
set to an empty value to disable the gateway token |
From the next run, that agent bills to your Anthropic account. Other agents keep using the built-in gateway until you change them too.
You can also run agents on a Claude subscription instead of an API key: clear the same two gateway variables (and set no ANTHROPIC_API_KEY), then use the agent’s sign-in flow — Paperclip surfaces the Claude login link when the CLI needs it.
Codex and OpenCode agents
Section titled “Codex and OpenCode agents”The built-in gateway only covers Anthropic traffic. Agents that run the Codex or OpenCode CLI always use your key: set OPENAI_API_KEY (and any other provider variables the CLI supports) in the agent’s environment editor, ideally as a secret reference.
Custom endpoints
Section titled “Custom endpoints”The environment passes through to the CLI verbatim, so OpenAI-compatible gateways such as OpenRouter or a self-hosted LiteLLM work the same way: point the CLI’s base-URL variable (ANTHROPIC_BASE_URL, OPENAI_BASE_URL) at your endpoint and supply its key.