> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atomscale.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Accounts

> Bill the Assistant's Claude models to your organization's or your own Anthropic account

The Assistant can run on Claude (Opus 5.5 or Fable 5.1). Claude requests are billed to an Anthropic account, which you can bring in two ways:

* **Organization connection**: An admin connects your organization's Anthropic org once. Every member's Claude chats then bill to it, with no API keys to hand out.
* **Personal API key**: A member adds their own Claude API key, and their chats bill to their own Anthropic account.

When both are set up, a member's personal key takes precedence. Without either, selecting Claude opens a prompt that takes members to these settings, and the Assistant's default model stays available.

## Connect your organization

An organization admin connects your Anthropic org through [Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation). Your Anthropic org trusts short-lived identity tokens that Atomscale signs for your organization, so no API key is created or shared. You can revoke access at any time by archiving the federation rule.

**Prerequisites**:

* The admin role in your Atomscale organization.
* The admin or owner role in your Anthropic organization, in the [Claude Console](https://platform.claude.com).
* Billing set up for the Anthropic workspace you'll use.

The Atomscale and Anthropic steps can be done by different people.

<Steps>
  <Step title="Open the Claude settings in Atomscale">
    In the Assistant panel, open the **…** menu, select **Settings**, then open the **Claude** tab. Under **Organization Anthropic account**, Atomscale shows the **Issuer URL** and **Rule subject** for your organization. You'll paste both into the Claude Console.
  </Step>

  <Step title="Create a service account">
    In the Claude Console, go to [Settings → Service accounts](https://platform.claude.com/settings/service-accounts) and create a service account, for example `atomscale-assistant`, with the **Developer** role. Service accounts are members of the Default Workspace automatically. To bill a different workspace, add the service account to it.
  </Step>

  <Step title="Add Atomscale as an issuer">
    Go to [Settings → Workload identity federation](https://platform.claude.com/settings/workload-identity-federation), open **Issuers**, and add an issuer:

    * **Issuer URL**: The Issuer URL from Atomscale.
    * **JWKS source**: Discovery. Anthropic fetches Atomscale's public signing keys from the issuer URL, so you don't need to do anything when Atomscale rotates its keys.
  </Step>

  <Step title="Add a rule">
    Open **Rules** and add a rule:

    * **Issuer**: The issuer you just added.
    * **Subject**: The Rule subject from Atomscale, exactly as shown. Don't add a trailing `*`, which would turn it into a prefix match.
    * **Audience** (optional): `https://api.anthropic.com`
    * **Service account**: The service account you created.
    * **Workspace**: The workspace that Claude usage should bill to.
    * **OAuth scope**: `workspace:inference`. This allows Claude requests and model lookups, and nothing else.
  </Step>

  <Step title="Connect in Atomscale">
    Back in the **Claude** tab, enter:

    * **Organization ID**: Your Anthropic organization's ID, under **Settings → Organization** in the Claude Console.
    * **Federation rule ID** (`fdrl_…`) and **Service account ID** (`svac_…`).
    * **Workspace ID** (`wrkspc_…`): Only needed if the rule covers more than one workspace.

    Choose a **Default model for members**, then select **Connect**. Atomscale checks the connection with Anthropic before saving it, and tells you what to fix if the check fails.
  </Step>
</Steps>

<Tip>
  If your Claude Console offers a **Connect workload** wizard, choose **Custom OIDC** and enter the same values. The wizard creates the service account, issuer, and rule in one flow.
</Tip>

### What members see

Once your organization is connected, members choose Opus 5.5 or Fable 5.1 from the model menu in the Assistant and can set the reasoning effort for each chat. The first time they select Claude, they confirm that chats will be sent to Anthropic. If a member hasn't picked a model, the organization's default is used.

Usage appears in your Anthropic workspace and counts against that workspace's rate limits and spend limits.

<Note>
  Fable 5.1 isn't available to Anthropic orgs with zero data retention unless Anthropic has authorized it. If that applies to you, choose Opus 5.5 as the default model.
</Note>

### Change or disconnect

* **Change the connection**: Select **Edit** in the **Claude** tab to update the IDs or the default model. Atomscale checks the connection again when you save.
* **Disconnect**: Select **Disconnect** to stop running your organization's Claude chats on your Anthropic org. To revoke Atomscale's access completely, also archive the federation rule in the Claude Console, which takes effect immediately.

### Troubleshooting

| Message | What to check |
| - | - |
| Anthropic rejected the token exchange | In the Claude Console, open **Workload identity federation → Authentication events**. Each attempt lists why it failed, for example a subject that doesn't match the rule. |
| The connection works, but its workspace can't use a model | The workspace doesn't have access to that model. Choose another default model, or check the workspace's model access. |
| The rule's scope doesn't allow inference | Set the rule's OAuth scope to `workspace:inference` or `workspace:developer`. |
| Your organization's Anthropic account doesn't have enough credit | Add credit to the Anthropic account in the Claude Console. |

## Use your own API key

Any member can use Claude with their own Anthropic API key:

1. Create a key in the [Claude Console](https://platform.claude.com/settings/keys).
2. In the Assistant panel, open the **…** menu, select **Settings**, then open the **Claude** tab.
3. Paste the key under **Your Claude API key** and select **Save key**.

Atomscale checks the key with Anthropic before saving it, so a mistyped or revoked key is caught right away. The key is then encrypted with a dedicated AWS KMS key before it's stored, and it's never shown again: the settings show only its last four characters. It's decrypted only for your own Claude requests, and it works on any device you sign in to. Select **Remove** to delete it.

Your key applies to every organization you belong to in Atomscale, and it takes precedence over any organization connection.

Claude Pro and Max subscriptions can't be used with Atomscale, because Anthropic only permits them in its own apps. Use an API key from the Claude Console instead.

## Billing

Anthropic bills Claude usage directly to the account it runs on, at its standard API rates for the chosen model. Atomscale doesn't add a charge or pass through costs.

* **Organization connection**: Usage is recorded against the workspace in your federation rule and paid through your Anthropic organization's billing. You can see it on the Claude Console's usage and cost pages, filtered by workspace.
* **Personal API key**: Usage bills to the Anthropic workspace the key belongs to.

The model, the reasoning effort, and the length of the conversation drive the cost: every message sends the chat history and tool results along with it. Session titles and memory summaries run on Atomscale's own model and are never billed to your Anthropic account.

Claude used through the [MCP server](/mcp-server), for example from Claude Desktop or Claude Code, is billed by that client to your own Claude plan or API account, regardless of these settings.

## Data handling

Chats that use Claude are saved in Atomscale like any other Assistant chat. Anthropic processes the requests under the account they're billed to, so that account's agreement with Anthropic and its data retention settings apply. See [IP and Data](/platform/reference/ip-and-data) for how Atomscale handles your data.

An organization connection stores no secret at all: Atomscale keeps only the IDs you enter, and each request uses a short-lived token from Anthropic. A personal API key is stored only in encrypted form, as described in [Use your own API key](#use-your-own-api-key).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.