If you already pay for Claude Pro/Max or ChatGPT Plus/Pro, polyrouter can route your agents through that subscription instead of billing you per token against an API key. You connect it once through a guided OAuth flow; polyrouter stores the tokens encrypted, refreshes them before they expire, and keeps your fallback chain serving if a grant is ever revoked.
The one-time connect, the automatic refresh loop, and what happens when a grant is revoked.
What this replaces
Where this fits next to the vendor path
Routing a subscription through a gateway is not something we invented, and it is worth being precise about what is already supported before saying what polyrouter adds.
Anthropic documents two modes for Claude Code. With a gateway credential active, the credential replaces the subscription login and that traffic is billed per token to whoever owns the credential. But setting only the base URL, without a gateway credential, does not replace the subscription — requests still route through the gateway while the saved claude.ai login stays the active credential, provided the gateway forwards the OAuth capability in anthropic-beta. That path exists and it works.
What it does not give you is credential management. It passes through a login the developer already holds on that machine. polyrouter does something different:
A guided PKCE authorization-code flow against the provider's own identity service — not a token you paste, and not a login you have to keep alive by hand.
Encrypted storage with automatic refresh, so the grant survives restarts and is shared safely across instances.
The same treatment for ChatGPT as for Claude, behind one endpoint.
Reauthorize without downtime — a revoked grant is surfaced in the dashboard while your fallback chain keeps serving.
It will be available on Polyrouter Cloud, so you do not have to run the container to use it.
localhost:3001
Your keys, your accounts — requests go straight from this box to the provider.Add provider
Claude Pro / Maxsubscription
Healthy
https://api.anthropic.com/
credential set (encrypted)
Connected · auto-refreshes · expires in 7h
Reusing a flat-rate subscription may violate the provider's ToS. Add a pay-per-token fallback.
TestSync modelsModelsEditDelete
ChatGPT Plus / Prosubscription
Last action failed
https://chatgpt.com/
credential set (encrypted)
Sign-in expired — reconnect to keep routing through this subscription.Reauthorize
Reusing a flat-rate subscription may violate the provider's ToS. Add a pay-per-token fallback.
TestSync modelsModelsEditDelete
OpenAI (prod)API key
Healthy
https://api.openai.com/v1
credential set (encrypted)
TestSync modelsModelsEditDelete
Custom base URLs are SSRF-checked — private and metadata ranges are rejected. Credentials are encrypted at rest and never shown back.
Add provider · modal · Subscription
Choose a preset
Kind
API key
Subscription
Custom endpoint
Local
Connect a subscription
Claude Pro / MaxSign in with your account — tokens are stored encrypted and auto-refresh.
ChatGPT Plus / ProSign in with your account — tokens are stored encrypted and auto-refresh.
Other subscription (paste a credential)
Then paste what you land on
1. Open the sign-in link and approve access.
Open sign-in link
2. Paste what you land on — the full redirect URL or the code#state string.
Redirect URL or code
https://…/callback?code=…&state=… or code#state
BackConnect
Reusing a flat-rate subscription programmatically may violate the provider's ToS — pair it with a pay-per-token fallback.
The Providers page with a Claude Pro/Max subscription connected: credentials encrypted at rest, the grant auto-refreshing, and the terms-of-service caveat shown alongside it.
The connect flow
1Start
POST /api/providers/oauth/start with the preset mints a PKCE pair and state, stores a single-use connect session in Redis, and returns an authorize URL.
2Sign in & paste
You authorize at claude.ai or auth.openai.com. Claude uses a code-display callback — the page shows a code#state string to copy. ChatGPT redirects to a dead localhost tab: the page fails to load and you copy the whole URL from the address bar. The paste field accepts either form.
3Complete
POST /api/providers/oauth/complete verifies the state, exchanges the code, encrypts the typed token envelope, and writes a kind=subscription provider.
Presets & wire headers
Claude Pro / Maxpreset: claude
Protocol anthropic_compatible. Models are synced from /v1/models with the OAuth token.
Protocol openai_responses. A streaming-only backend folded into buffered responses; no models endpoint — models are bundled and a probe model validates the connection.
Authorization: Bearer …chatgpt-account-id: …OpenAI-Beta: responses=experimentalno x-api-key · no fingerprints
Refresh & rotation safety
Pre-request only. Credentials resolve at adapter-build time on every proxied request; a token more than five minutes from expiry is served straight from the decrypted envelope.
Single-flight. At most one refresh per provider per instance — concurrent requests share the one in-flight refresh.
Advisory-locked. The refresh re-reads the envelope inside a per-provider lock; credential edits and reauthorize completions serialize on the same lock, so a refresh can never clobber a concurrent change.
Rotation-safe. Refresh tokens rotate, and the locked re-read always refreshes from the newest envelope.
Breaker-neutral. A credential failure is fallback-eligible and never trips the circuit breaker.
Reauthorize vs refresh
Automatic refresh
Runs near expiry, before the request. The breaker is never reset — it preserves genuine upstream failure history. A transient identity-provider failure serves the still-valid token behind a 30-second backoff.
One-click Reauthorize
When a credential goes durably bad, polyrouter persists credential_error: reauthorize_required and stops re-probing per request. The dashboard surfaces a Reauthorize action that runs a fresh connect flow bound to the same provider row and resets the breaker.
Heads-upReusing a flat-rate consumer subscription programmatically may violate the provider's terms of service. Pair a subscription provider with a pay-per-token API-key fallback in the tier chain — the dashboard surfaces this when you connect one.
Two ways to run it
Self-hosting works today — one container, your keys, your box. Polyrouter Cloud is the same router fully managed, with subscription routing included, and it is on the way.