# Connection modes

Per tool, whether requests run on the developer's own AI subscription or on your
organization's provider key.

## The two modes

**Subscription** — the developer's own plan pays. Sentilai governs and audits; billing is
unchanged.

**Managed API key** — the request goes out on a key from **Providers** and is billed to
you. One bill, central control, and you can cut off access by removing the key.

## Setting it

**Policy → Connection modes**, one selector per tool: Claude Code, Cursor, GitHub Copilot,
Gemini CLI, Codex CLI.

**Cursor is locked to managed API key.** Its custom-endpoint mechanism cannot carry a
subscription login, so governing Cursor requires an OpenAI provider key.

## The failure to expect

Managed mode with no matching provider key means requests fail — Anthropic for Claude
Code, OpenAI for Cursor and Copilot. The tool shows a provider error and Activity records
an upstream error. Add the key, or move that tool back to subscription.

## In the audit trail

Activity's **Mode** column shows which mode each request used, and Compliance reports the
subscription/API split. Both modes are audited identically; the only difference is who
pays.

<!-- shot:connection-modes -->
![Connection modes — how each tool’s AI traffic authenticates upstream: the developer’s own subscription, or a managed key from Providers.](https://docs.sentilai.com/uploads/images/gallery/2026-08/bPYconnection-modes.png)
*Connection modes — how each tool’s AI traffic authenticates upstream: the developer’s own subscription, or a managed key from Providers.*