---
title: AI accounts and subscriptions
description: Connect the AI source for AI Chat (API keys, OpenRouter or Google sign-in, the panel provider) and use your own Claude, ChatGPT or Gemini subscription through the official CLIs.
url: https://nexcmp.com/docs/configure-with-ai/ai-accounts-and-subscriptions/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# AI accounts and subscriptions

> **Where in the admin:** System › Settings › AI accounts (`/agent/accounts`), tabs **Accounts** and **Use your own AI subscription**. The optional terminal is AI Console (`/agent/console`), which appears under AI Chat only when it is turned on.

## What it does

AI Chat needs something to answer with. This page lets you connect that source for your own admin account:

- **API sources**: OpenAI, Anthropic (Claude), Google Gemini and OpenRouter, with an API key or a sign-in.
- **The panel AI provider**, if you already set one under System › Settings › AI provider.
- **Your own AI subscription** (Claude, ChatGPT, Gemini) through the vendor's **official command-line tool**, either on the panel server or on your own computer.

Everything you connect belongs to your admin account. Keys and tokens are stored encrypted for you alone; another administrator cannot use them.

## Requirements

| Item | Requirement |
|---|---|
| Role | A signed-in administrator. On a demo panel nothing can be connected or removed. |
| API sources | An account and an API key at the vendor (the card has a **Get API key** link that opens the vendor page). |
| CLI on the panel server | AI Console turned on (see below), outbound HTTPS from the server to the vendor and to `nodejs.org` and the npm registry, and **2 GB of RAM or more** (a CLI needs about 1 GB free while it runs; the installer warns below 2 GB). Node.js 20 or newer is used if present, otherwise the installer downloads Node.js 22 with a checksum check. |
| CLI on your computer | Node.js 20 or newer to install the CLI, and your own subscription. |

## Connect an API source

1. Open **System › Settings › AI accounts** and stay on **Accounts**.
2. On the card of the source click **Connect**. The vendor's key page opens in a new tab; create a key there.
3. Paste the key into the field and save. The card shows a connected state with the last four characters.
4. Choose the **default model** if you want a different one, then click **Test**. A good result reads like "Connected - example-model, 850 ms".

![AI accounts page with the API source cards, a connected OpenAI card and the Panel AI provider card](https://nexcmp.com/docs/images/configure-with-ai/ai-accounts-and-subscriptions-01-accounts.webp)

| Source | Sign-in alternative |
|---|---|
| OpenRouter | **Sign in with OpenRouter** opens OpenRouter in a popup or tab; approve and you return to this page connected. |
| Google Gemini | **Sign in with Google** appears after you have saved, under **Set up Google sign-in (optional)** on the card, an OAuth client created in **your own** Google Cloud project (client ID ending in `.apps.googleusercontent.com`, plus its secret). NexCMP ships no shared Google client. |
| Panel AI provider | Uses the provider already configured under System › Settings › AI provider ([AI provider](https://nexcmp.com/docs/ai/ai-providers/)). Nothing to paste. |

To disconnect a source click **Remove** on its card. It deletes the stored key for your account.

### Defaults, daily cap and permissions

At the bottom of the **Accounts** tab, **Defaults for AI Chat** has three settings:

| Setting | Meaning |
|---|---|
| Default source and model | What new chats use. You can still change the source per message. |
| Daily spending cap (USD, 0 = no limit) | Default 5. The page shows "used today". See [AI Chat in the admin](https://nexcmp.com/docs/configure-with-ai/ai-chat-in-admin/#daily-spending-cap). |
| Chat session permissions | The scopes the assistant may use. `admin:read` is always on; `secrets:write` is off by default. See [Admin API keys](https://nexcmp.com/docs/configure-with-ai/admin-api-keys/#scopes). |

Click **Save defaults**.

## Use your own AI subscription

You can drive NexCMP with a Claude, ChatGPT or Gemini plan you already pay for, without a separate API key. There are two ways.

### Way 1 (recommended): the CLI on your own computer

You use the vendor's own tool on your own computer and sign in with your own account in the vendor's normal way. NexCMP only receives MCP calls signed with a short-lived key. Open **AI accounts › Use your own AI subscription**; it shows three steps per tool.

1. Click **Create a 7-day key** and choose the level: **Read only** (`admin:read`) or **Read + configuration** (`admin:read`, `catalog:write`, `infra:write`, `settings:write`). The commands below then contain the real key.
2. Install the CLI and sign in. The key is shown only on this page and only once.

   | Tool | Install | Sign in |
   |---|---|---|
   | Claude Code | `npm install -g @anthropic-ai/claude-code` | run `claude`, then `/login` |
   | Codex CLI | `npm install -g @openai/codex` | `codex login` |
   | Gemini CLI | `npm install -g @google/gemini-cli` | run `gemini`, choose "Login with Google" |

3. Connect it to your panel with one command or one block, copied from the page:

   ```bash
   # Claude Code
   claude mcp add --transport http nexcmp https://cloud.example.com/mcp/admin \
     --header "Authorization: Bearer ak_XXXX"
   ```

   ```toml
   # Codex CLI: ~/.codex/config.toml, then: export NEXCMP_KEY=ak_XXXX
   [mcp_servers.nexcmp]
   url = "https://cloud.example.com/mcp/admin"
   bearer_token_env_var = "NEXCMP_KEY"
   ```

   ```json
   // Gemini CLI: ~/.gemini/settings.json
   { "mcpServers": { "nexcmp": {
       "httpUrl": "https://cloud.example.com/mcp/admin",
       "headers": { "Authorization": "Bearer ak_XXXX" } } } }
   ```

4. Start the tool and ask, for example, "what is left to set up in nexcmp?". All details of the MCP connection are in [Connect an AI client](https://nexcmp.com/docs/configure-with-ai/mcp-admin/).

The same tab shows the URL for the **claude.ai** and **ChatGPT** connectors, which sign in with OAuth and need no key: [OAuth connectors](https://nexcmp.com/docs/configure-with-ai/oauth-connectors/).

![Use your own AI subscription tab with the 7-day key button and install, sign in and connect commands for three CLIs](https://nexcmp.com/docs/images/configure-with-ai/ai-accounts-and-subscriptions-02-subscription.webp)

### Way 2: the CLI on the panel server (Install / Login buttons)

The cards under "Subscription through a CLI (Claude, ChatGPT, Gemini)" let NexCMP install the official CLI on the panel server and open its own sign-in flow, so **AI Chat** can answer with your subscription.

**How it is isolated.** The CLIs run in a separate process (`nexcmp-ai.service`) as their own system user `nexcmp-ai`, without sudo, with no access to NexCMP's data and configuration folders and a memory limit. For every AI Chat message the CLI is started with only the NexCMP MCP tools allowed (shell and file tools are off) and a key that works from the server only. NexCMP does not read or copy the CLI's sign-in: the CLI keeps it in a private folder for your admin account.

There is nothing to turn on: the panel sets up the `nexcmp-ai` user and service when it is installed or updated to 1.4.0, so the cards are ready to use.

**Install and sign in (per administrator):**

1. On the card of the CLI click **Login**. If the CLI is not installed yet, the panel installs it first: a progress bar and a short log show the download (Node.js if needed, then the CLI). A warning appears when the server has less than 2 GB of RAM.
2. The card shows what the CLI asks for:
   - **Codex CLI**: click **Open the sign-in page** and type the one-time code the card displays. (OpenAI's device sign-in must be enabled in your ChatGPT security settings.)
   - **Claude Code and Gemini CLI**: click **Open the sign-in page**, sign in, then paste the verification code the vendor's page shows into **Paste the verification code here** and click **Send code**.
3. The card turns to "Signed in" with the account and version. A sign-in that is not finished within 10 minutes is cancelled; click **Login** again.
4. In **AI Chat** the source now appears in the selector (for example "ChatGPT (via Codex CLI)").
5. **Sign out** removes the CLI's sign-in for your account.

For Claude the card has an extra switch, **I understand and accept the vendor's terms for using a subscription this way**, off by default. The source is not offered in AI Chat until it is on.

![CLI subscription cards with Install and Login, a one-time code on the Codex card and the I understand switch on the Claude card](https://nexcmp.com/docs/images/configure-with-ai/ai-accounts-and-subscriptions-03-cli.webp)

### Terms of the AI vendors

Signing in with a consumer subscription is governed by each vendor's terms, which change. The notes below are a summary of what the vendors publish as of October 2026, not legal advice and not a statement on the vendor's behalf. Read the current pages before you turn this on.

| Vendor | What the vendor's page covers | Source |
|---|---|---|
| Anthropic (Claude) | Signing in to the unmodified Claude Code with your own plan is covered. Using a subscription through other products, or having a product collect or pass on the sign-in, is treated differently, and plan limits assume ordinary individual use. This is why the Claude card carries a note and the **I understand** switch, and why Way 1 is the cleaner choice. | https://code.claude.com/docs/en/legal-and-compliance |
| OpenAI (Codex) | Codex supports signing in with a ChatGPT account or an API key. OpenAI recommends API keys for automation and says not to expose Codex in untrusted or public environments. Use the card only for yourself. | https://developers.openai.com/codex/auth |
| Google (Gemini CLI) | Supports Sign in with Google, an API key and Vertex AI; the terms depend on how you sign in, and your plan's quotas apply. | https://geminicli.com/docs/get-started/authentication |

If you want to avoid the question entirely, use an **API key** source, or Way 1 on your own computer.

## AI Console

AI Console is an optional terminal page for running one of the signed-in CLIs on the panel server. It is **off by default**.

- Turn it on or off, and manage the CLIs, on the server:

  ```bash
  sudo nexcmp ai-console enable          # turn on (also creates the nexcmp-ai user and service)
  sudo nexcmp ai-console disable         # turn off
  sudo nexcmp ai-console status          # runner, console state and installed CLIs
  sudo nexcmp ai-console install claude  # or codex, or gemini
  ```

  `status` prints whether the AI runner socket is ready, whether AI Console is enabled or disabled, and for each CLI "installed" or "not installed". `sudo nexcmp status` also shows "AI runner: active".
- Once enabled, an **AI Console** tab appears under AI Chat. Pick a signed-in CLI, re-enter your admin password (and your 2FA code if you use it) and open a session. A banner reminds you that commands here can only manage NexCMP through its MCP tools; shell and file tools are disabled.
- Demo installations never create the `nexcmp-ai` user.

![AI Console start screen with the CLI selector, password field and the MCP-only warning banner](https://nexcmp.com/docs/images/configure-with-ai/ai-accounts-and-subscriptions-04-console.webp)

## Verify

1. **Test** on an API source returns the model name.
2. On the CLI card the state reads "Signed in" with the account.
3. On the server: `sudo nexcmp ai-console status` lists the CLI as installed, and `systemctl is-active nexcmp-ai` prints `active`.
4. In AI Chat choose the source, ask "Check my setup progress", and a tool card appears.

## Limits & notes

- A CLI answer is limited to 5 minutes and one answer at a time per administrator. The daily cap does not count CLI answers.
- Every change from a CLI source is still a confirmation card in AI Chat; the CLI cannot apply changes by itself.
- Subscription plans have their own usage limits. When the vendor says "usage limit" or "not logged in" the chat shows that message.
- Removing a source does not delete conversations.
- Keep the server patched: the CLIs are installed from the vendors' public packages at the time you click Install.

## Troubleshooting

| Symptom | Cause | Fix |
|---|---|---|
| Login is disabled and the card says "AI tools are not ready on the server yet" | The `nexcmp-ai` service is not running | Update the panel to the latest version, then check `sudo nexcmp status`. On the read-only demo this is expected. |
| "AI tools are not installed on this server yet" | The `nexcmp-ai` service is not running (older panel, or a demo panel) | Update the panel, then `sudo nexcmp ai-console install claude` (or `codex`, `gemini`). |
| Warning about RAM below 2 GB | The server is small | Install may be slow or fail; add memory or use Way 1. |
| "Node.js download checksum mismatch" or "download failed" | The server cannot reach nodejs.org, or a proxy altered the download | Allow outbound HTTPS and retry. |
| Install ends in an error | npm could not install the package | Read the log on the card, check outbound access to the npm registry, retry. |
| Login ends in an error or times out | The 10-minute window passed, or the code was wrong | Click **Login** again and complete it faster. |
| The Claude source is missing in AI Chat | The **I understand** switch is off, or the CLI is not signed in | Turn the switch on after reading the vendor's page, then sign in. |
| "Sign in with Google" is missing on Gemini | No Google OAuth client saved yet | Create the client in your own Google Cloud project and save it under **Set up Google sign-in (optional)** on the card, or paste an API key instead. |
| "Sign in with OpenRouter" returns an error | You cancelled, or the popup was blocked | Allow popups and try again. |
| The CLI answer says "usage limit" | The plan's quota is used up | Wait, or switch source. |