Subscriptions

You already pay for Claude or ChatGPT. /login spends that plan instead of an API key, with no relay in the middle and no second tool to install. Empryo runs the OAuth flow, keeps the credential in your system keychain, and refreshes it when it expires.

Several accounts sign in this way today. Most run an OAuth flow (browser or device code); a couple take a pasted key instead of a browser login, but all live under the same Subscriptions provider:

Gemini CLI and Antigravity both serve gemini-* base models, so each lane namespaces its ids under its own account (google-gemini-cli/…, google-antigravity/…) to keep billing and routing unambiguous. Cursor and Devin namespace the same way so a shared base id (a claude-* or gpt-*) never steals another lane's turn.

Signing in

Run /login on the terminal or the desktop app. The picker lists every account Empryo can sign into, marks the ones you are already on, and starts the flow you choose.

Sign in
  A  Claude Pro/Max              you@example.com
  O  ChatGPT Codex
  O  ChatGPT Codex (device code)
  ⌘  Cursor
  D  Devin
  G  Gemini CLI
  G  Antigravity
  K  Kimi Code (device code)
  F  Fire Pass                   paste key
  ☁  LLM Gateway                 signed in

Skip the picker with the account name:

/login claude          # Claude Pro/Max
/login codex           # ChatGPT, browser
/login codex-device    # ChatGPT, device code
/login grok            # Grok (xai-oauth resolves here too)
/login cursor          # Cursor, browser
/login devin           # Devin, browser
/login google-gemini-cli   # Gemini CLI (Google Cloud Code Assist)
/login google-antigravity  # Antigravity (Google)
/login kimi-code       # Kimi Code, device code
/login firepass <key>  # Fire Pass — paste an fpk_… key, no browser
/login ollama-cloud <key>  # Ollama Cloud — paste a key

Brand and vendor aliases resolve to the right lane: /login anthropic → Claude, /login chatgpt → Codex, /login xai-oauth → Grok.

The same names work without a UI:

empryo --headless --login claude
empryo --headless --login codex --no-browser

--no-browser prints the URL instead of opening one, for a machine you reached over SSH.

Picking an account you are already signed into asks first. Signing in again replaces the stored grant; signing out deletes it.

When the browser cannot reach you

Claude's callback listens on port 54545 and falls back to a random port if that one is taken. OpenAI validates the redirect URI against a registered address, so ChatGPT's callback must be port 1455 and cannot fall back. If something else holds 1455, the sign-in stops before it opens a browser and says so.

Use the device code when that happens, or when the browser lives on another machine:

/login codex-device

It prints a code, you type the code at auth.openai.com/codex/device, and no local port is involved.

Where the models show up

Every signed-in account appears under one Subscriptions provider, with a group per account. Model ids read subscriptions/claude-opus-5, subscriptions/gpt-5.6-sol, subscriptions/cursor/composer and so on, so moving between plans is a model choice rather than a provider migration.

Each lane discovers its catalog live: it asks the vendor's own API for the models the account can use, falls back to models.dev metadata for context windows and pricing, and finally to a pinned cold-start list when neither answers. A lane you are signed out of contributes nothing to the picker.

Sign out of a lane and its models leave the picker. Offering a model that fails on the first turn is worse than a shorter list.

What Empryo sends

A subscription token is not an API key. Anthropic and OpenAI serve it to their own client and identify that client by the shape of the whole request, so this lane reproduces it: the SDK telemetry headers, the beta list, the client's identity block ahead of your system prompt, and an attestation hash over the serialized body. Getting one of them wrong does not degrade the request, it gets it refused.

Two consequences worth knowing:

• Claude subscriptions carry no long-context credit, so Empryo never advertises the 1M beta on this lane. Models with a native 1M window still serve it.
• The ChatGPT backend only streams. A non-streaming call fails there with a readable error rather than a corrupted response.

Claude expires every 30 days

Anthropic ends the whole refresh-token family about 30 days after you sign in, however healthy the rotations have been. Only signing in again recovers it.

Empryo tracks the deadline from your login and warns on the account row inside the last five days:

A  Claude Pro/Max     sign in again within 4d

Run /login claude before it lapses and nothing breaks mid-turn.

Signing out

/login, pick the account, choose Sign out. That deletes the stored credential. It does not touch the account itself, and signing in again is the same flow as the first time.

Subscriptions, proxy, or an API key

Run both if you like. They are separate providers with separate credentials, and a model id says which one serves the turn.

More than one account

Sign in again from /login and pick Add another account. Both plans stay signed in, and the picker marks the one paying for the next turn.

One email can hold more than one subscription (a Team seat and a personal Max plan). Empryo keys accounts by organization as well as by account, so those are two rows, not one overwriting the other.

When a plan runs out, Empryo moves to the next one. The exhausted account sits out until its window resets, and the terminal says which account took over, beside the plan meter. Two things keep that honest:

• Only an exhausted plan triggers a switch. Ordinary throttling ("too many

requests") is waited out on the same account, because benching a healthy subscription for an hour over a momentary blip is the worse mistake.

• Limits are per model family. A spent weekly cap on one family does not

sideline the account for the others.

Empryo also switches *before* a request when the meter already says the active plan is spent, so a long turn does not die halfway to discover it.

Pick an account by hand any time from /login. The same list switches, adds and signs out, one account or all of them.

What is left of the plan

Empryo asks each vendor's own usage route with the credential it holds, so the numbers match what the vendor's app shows: the 5-hour window, the weekly one, and the per-model weekly caps where the plan has them, each with its reset time.

On a subscription model the status bar wears the plan meter, on the terminal and the desktop app alike. /usage lists every window per account, the desktop Usage Center gives each signed-in plan its own card, and a Hearth chat answers /subscriptions with native and relay plans in one report.

Per-token cost and cached-token figures Empryo shows on these lanes are estimates derived from token counts and models.dev pricing, not billed invoices. A subscription bills against your plan's windows, so read the plan meter for what you have spent — the dollar estimate is a guide, not the vendor's ledger.

Troubleshooting

Related

• Proxy - the same kinds of plan through the relay add-on, for several accounts per provider
• GitHub Copilot - the other flat-rate plan, billed monthly
• Providers overview - every provider Empryo speaks
• Cost tracking - what per-token spend looks like next to a plan