# Subscription or managed key

Every governed request runs in one of two **modes**, and the difference is who pays.

## Subscription

The developer's own AI subscription pays for the request. Claude Code with a personal or
company Claude plan is the common case. Sentilai governs and audits the request but does
not touch billing.

Use this when your developers already have subscriptions you are happy with, and you want
governance rather than centralized spend.

## Managed API key

The request goes out on **your** provider key, from **Providers**, and is billed to your
organization. You get one bill, per-model control through the key's enabled-models list,
and the ability to cut off access by removing the key.

Use this when you want the spend centralized or when the tool cannot carry a subscription
login.

## Setting it

**Policy → Connection modes**, per tool. Claude Code, Cursor, GitHub Copilot, Gemini CLI
and Codex CLI each get their own setting.

**Cursor is locked to managed API key** — its custom-endpoint mechanism cannot carry a
subscription login. If you want Cursor governed, you need an OpenAI provider key.

## What goes wrong

- Managed mode with no matching provider key: requests fail. The tool shows a provider
  error and Activity shows the request with an upstream error. Add the key.
- Managed mode with two keys of the same type whose model lists overlap: Sentilai cannot
  tell which key you meant and refuses the request. Make each key's **enabled models**
  list distinct.

Both modes are audited identically. In **Activity**, the **Mode** column tells you which
one a given request used.