Can an AI gateway use your ChatGPT or Claude subscription?

The short answer

Usually, no. A ChatGPT, Claude, Gemini, Copilot, Cursor, or Windsurf subscription is not automatically a reusable API account. The subscription pays for access through the vendor's approved products. A provider API key is a separate credential with its own billing, limits, and administrative controls.

There is one important exception: some installed clients let a person sign in with a subscription and authorize that specific client. A local gateway connector can preserve that vendor-authorized session only after the exact client path has passed compatibility and security acceptance. The subscription credential stays on the person's device; it is not converted into a provider key or uploaded to AI Gateway HQ.

Four connection types that should not be confused

Before connecting anything, identify which account actually pays for the model request and which credential the software is authorized to use.

• Consumer subscription: access purchased for an approved vendor application, such as ChatGPT with Codex or Claude with Claude Code.
• Provider API account: usage-based access through an API key, workload identity, or another provider-supported machine credential.
• Managed model account: model access supplied through a cloud platform such as Amazon Bedrock, with separate cloud billing and permissions.
• Gateway workload key: a limited credential issued to one application or environment. It authorizes the gateway; it is not a model-provider credential.

What BYOK means in AI Gateway HQ

Bring your own key means that your organization supplies a provider API credential it is authorized to use. The gateway encrypts that credential, does not display it after submission, and gives each application a separate workload key. Routes, budgets, rate limits, fallback, and audit evidence apply at the gateway without placing the provider secret in every application.

The provider continues to bill the provider account. AI Gateway HQ does not turn subscription allowance into API credit, resell a personal login, or make consumer credentials portable. If you do not want a separate provider API account, eligible prepaid managed Bedrock is the current alternative for live model traffic.

When subscription continuity is possible

A safe subscription connector runs locally and uses the vendor's documented sign-in path. It keeps the saved session and request content on the device while sending only bounded operating metadata to the gateway control plane. It must fail closed if the client, authorization method, model, streaming behavior, tool state, or fallback target has not passed acceptance.

The authenticated Client continuity page is the current-release compatibility matrix. Codex CLI and Claude Code connectors are in client validation and are not generally downloadable today. Gemini CLI and Copilot CLI remain separate BYOK paths. Cursor and Windsurf subscription credentials are not imported or proxied. Those states will change only after exact-client acceptance, not because a marketing page promises support.

What you should never provide

Do not paste a password, passkey, browser cookie, session token, personal OAuth token, or exported credential store into an AI gateway. Do not let a service automate a consumer login unless the vendor explicitly authorizes that integration. A legitimate gateway should name the credential type, who retains it, who is billed, how it is revoked, and what happens when authorization expires.

Choose the right path

Use BYOK when your organization already owns a supported provider API account and wants centralized controls without changing who pays the provider. Use prepaid managed Bedrock when you want a bounded live-model path without opening a separate provider API account. Use a subscription connector only when the portal marks the exact client as available and the local installer keeps the vendor session on your device.

If you are evaluating the product, start in the no-card Test Lab. It demonstrates identity, policy, routing, budget, fallback, and evidence with synthetic traffic, so no provider credential or paid model call is required.