How do you keep API keys off developers' laptops with Claude Code and Codex?

A provider key on a laptop has left your control. It can be copied into a .env file, committed with a repository, or read by any program started from the shell that exports it. Taking it back means revoking it at the provider and giving a new one to everyone who shared it.

A key per developer, each with its own cap, at least tells you who spent what. It also leaves you one key per person per provider to issue, track and revoke, and a list to go through every time somebody leaves.

Yes. A developer signed in to their own Claude or ChatGPT subscription needs no API key. It costs a seat per person per provider, though, and a subscription is a flat fee paid whether the seat is used or not.

Seats that get used are worth keeping. Selan connects the ones you already pay for, uses them first, and falls through to a key billed per token only when they are busy.

It holds the provider keys and attaches one to each request on its way out.

A gateway you run yourself moves the keys to a server, and you still issue and revoke whatever credential developers use to reach it.

selan login opens Google or Microsoft sign-in in the browser. Over SSH it prints a URL to paste instead. Afterwards the machine holds one revocable Selan session token and nothing else: no Anthropic key, no OAuth account.

selan claude starts Claude Code pointed at Selan's gateway, with that session token as its credential. An ANTHROPIC_API_KEY already exported in the developer's shell is dropped at launch, so it never reaches the wire.

selan codex writes one provider block into ~/.codex/config.toml. The block names an environment variable instead of holding a credential, and Selan exports that variable only for the length of a selan codex launch. A bare codex therefore fails closed instead of spending the company's account.

Signing in is described in the docs, and the Codex block line by line in Codex.

In Selan's control app, where each account is added once for the whole company. Every credential is verified with the provider when it is added and encrypted before it is stored. It is never shown again, not even to whoever added it.

Anthropic, OpenAI, Google Vertex, OpenRouter, nexos.ai and a model you host yourself can all be connected this way. They stay your accounts, and the provider keeps billing you directly. Which providers resolve which model ids is in Providers.

Revoking a member ends their sessions immediately, along with every access token they created. selan logout revokes the session on one machine.

A session expires after thirty days without use, and every request resets that clock. A laptop that goes quiet stops working within the month, even if nobody remembers to revoke it. No provider key needs rotating, because none was ever on the laptop.

An unattended job has no browser to sign in with, so an owner mints it an API token in Selan instead. The job carries it as SELAN_TOKEN. There is no sign-in, and nothing is written to disk, so no credential gets baked into a container image.

A token spends as itself, under an address of its own like ci-nightly@tokens.selan.ai, so the job's bill does not land on whoever set it up. Only owners can mint one. It expires after 1, 30, 90 or 365 days or never, is shown once, and is revoked from the same panel.

The setup is in Running unattended.

Every request shows up under the person who made it, with the model and what it cost. A spend limit per person, by day, week or month, follows them across every API key you connected. With secret scanning on, a key pasted into a prompt is replaced before the request goes to the provider.

The cost side is on the spend page, and redaction on the secrets page.

Free for up to three seats, and the Free plan needs no card.