Feature request: Support “bring-your-subscription” logins (e.g., OpenAI Codex) in addition to API-key/token billing

[zvictor]

Motivation

OpenFang’s Docker-first setup lowers friction because users can start without installing dependencies on the host machine (one of the biggest adoption wins for agent tooling).
The remaining adoption bottleneck is billing/auth friction: requiring users to provision per-token API keys (and manage spend) is a high-effort first step for people who already pay for an external AI subscription and want to “just sign in and go”.

Request

Please add an authentication + provider layer that supports:

• “Login with external subscription” flows (example: OpenAI Codex subscription) in addition to existing per-token API endpoints.
• A unified “Model Access” UI where users choose:
  • Subscription login (recommended default for individuals), or
  • API key (for teams, custom deployments, or explicit cost control).

If a first iteration can’t fully support subscription entitlements, an MVP that still helps a lot:

• OAuth-based sign-in + secure token storage
• A connector that uses the user’s existing subscription-backed access when available, falling back to API keys otherwise
• Clear capability flags per provider (what models/features are available via subscription vs API)

Acceptance criteria

• A new auth option exists: “Sign in with OpenAI (Codex)” (or similarly named), alongside “Use API key”.
• After signing in, a user can run a basic OpenFang workflow without manually creating/storing an API key.
• The system clearly shows which provider is active (Subscription vs API key) and what limits apply (rate limits, model availability).
• Admin-friendly controls exist for self-hosted/team setups: disable subscription login, enforce API keys, or allow both.

Why this matters (product outcome)

• Reduces time-to-first-success (TTFS): from “create key → configure env → worry about spend” to “login → run”.
• Improves conversion for non-enterprise users who already pay for an AI tool and don’t want a second billing surface on day one.

[jaberjaber23]

Thanks for the detailed feature request. This is on our radar.

For now, OpenFang supports API keys and OAuth2 PKCE flows (via the extensions system). The GitHub Copilot provider already does token exchange automatically (set GITHUB_TOKEN and use provider = "github-copilot").

Adding subscription-based auth for OpenAI and other providers is planned. We'll track this as a feature request.