Provider connections are account-owned, encrypted broker records. Their owners control named-member delegation and Factory sponsorship; Forgejo sign-in, Project membership and the operator's appliance-capacity grant remain separate.
Enroll or reconnect an account
Soda supports Codex ChatGPT and Muse Code subscription device sign-in. From a signed-in page, choose AI providers in the navigation to open the Providers dialog. The control may take you to the Feed to open that dialog. Choose the provider and complete its native device sign-in. Confirm its status is Connected, rather than Awaiting sign-in, before launching the corresponding CLI.
When more than one authorized connection is available, select the intended connection for the run. If the provider rejects a credential or requires renewed sign-in, reconnect that account through the same controls.
Connected provider status shown to its account owner without exposed sign-in material.
Delegate a subscription in one Project
Before delegating, confirm that the provider permits the selected member to use your subscription and that you trust code running under that member's Project account with the execution credential. Delegation is controlled credential exposure, not a provider-issued account for that member.
- Open provider connection controls in the intended Project and select the connection you own.
- Under Delegate this subscription in this project, select the named Project member.
- Confirm both the provider-terms permission and credential-exposure acknowledgments, then choose Authorize named member.
- Inspect the resulting grant for the intended user and Project. The member must also have current provisioned membership and repository execution authority; the grant does not create either.
The authorized member can use that subscription through managed tooling in the named Project. A grant for one member and Project does not authorize other members or other Projects. Follow Connect and develop for personal CLI use and connection selection.
Choose an account for personal Muse use
The connection owner is the person whose enrolled subscription supplies the credential. You can use your own authorized Muse connection or one explicitly delegated to you in the current Project. A connection's display label helps identify it; that label, the owner's name and the provider name are not its connection ID.
With exactly one ready, authorized Muse connection and no explicit selection, the normal muse command chooses that connection. Several eligible connections require an exact connection ID; Soda does not choose an arbitrary account. A selected connection must still be ready, belong to Muse and be authorized for your current Project account.
Use Muse connection selection for the invocation syntax and launch diagnostics to distinguish an ambiguous choice, denied authority, an unavailable launch service and rejected provider credentials.
Understand subscription use and custody
Subscription limits and provider quota remain with the provider account. Soda-managed execution uses subscription authentication; an expired or rejected credential or exhausted subscription stops and explains the required action. Soda does not silently switch to API billing, another account, another provider or another authentication method. A managed CLI uses a connection and Project grant authorized for the requesting member.
The broker keeps credentials out of prompts and shared Project files, but the authorized tool receives the upstream account credential. Code running under that Project login can read or copy it; host administrators and Project root/wheel are also trusted. The provider sees the connected account. Soda cannot invalidate copied credentials, recall requests the provider already accepted, or restrict where authorized repository code sends data. Provider-side logout or revocation is a separate action.
Do not paste credentials into prompts, terminal transcripts, repositories or shared configuration. Ending one managed session does not terminate unrelated processes under the same Project account. Delegate only when these boundaries are acceptable.
| Provider | Active-use behavior | If a start cannot proceed |
|---|---|---|
| Codex ChatGPT | One active stream per connection across enrollment, personal tools and Factory use. Detaching the browser leaves the managed session running. | A busy connection is temporarily unavailable; inspect active use and end the intended session before retrying. Busy does not mean rejected credentials. |
| Muse Code | Independent concurrent leases; ending one execution leaves other authorized executions running. | A rejected credential requires device reconnection. An ordinary tool failure alone does not establish an authentication failure. |
A Soda sponsorship allowance authorizes a bounded amount of Factory work; it does not increase upstream subscription quota. Provider limits can stop a run even when Soda allowance remains available.
An authorized connection supports the owner's or delegated member's managed CLI use. Factory work also requires repository policy, capacity granted by the configured Soda operator and sponsorship from the connection owner; enrollment alone does not authorize or fund it.
Disconnect or revoke a connection
Select the connection and inspect its listed grants and active uses, including the actor and Project, before ending work. Use Revoke delegate for the named grant or End active use for the selected execution, then refresh and confirm the resulting state. Revoking a grant denies new use and retires its registered executions; ending active use alone does not revoke the member's grant.
If a connection needs attention, reconnect it using the provider's sign-in flow. To remove it, explicitly disconnect or revoke it in provider controls. Disconnect first denies new use and retires its managed executions; if retirement cannot be confirmed, the broker keeps the connection fenced from reuse until the outcome is reconciled.
Removing a grant can affect only the executions covered by that grant; it does not erase Project files. A rejected credential is a connection problem, while an ordinary CLI error is not proof that sign-in failed.
Enable Factory use separately
Provider account enrollment does not authorize autonomous Factory work or pay its ongoing costs. The repository's Factory policy, appliance capacity and explicit sponsorship are configured separately in Factory authorization. For human terminal and Project setup, provider connection is optional; see First connection.