Skip to documentation

Grant provider access

Grant provider access

Grant organization, user, or exact-key use of a connected subscription account.

HostedPro

Last updated August 18, 2026

View as Markdown

Purpose

Allow an organization, one user, or one exact User API key to send requests through a connected subscription account.

Prerequisites

The provider connection must be active. You need the connection-management permission for its owner scope. The target user or User API key must be active and verified by AnchorShell.

A product permission authorizes an operation. A provider use grant authorizes requests through one provider connection. The principal needs both relay:request and provider access.

Steps

  1. Open Relay → Providers.
  2. Find the connected provider account.
  3. Open its access management action.
  4. Select Organization, User, or API key when that scope is available.
  5. Select the verified target.
  6. Confirm that the grant scope is Use.
  7. Save the grant.

Use the narrowest scope that meets the requirement. Prefer an exact-key grant for one agent. Use a user grant when the user's browser traffic and all owned keys need the same connection.

A user grant includes active User API keys owned by that user. An exact-key grant includes only the selected key. The connection owner has implicit browser access. The owner's active User API keys can use the owner's subscription connection.

Personal non-subscription connections accept only a verified exact-key grant for a User API key owned by the same user.

Expected result

The granted principal can see eligible Models from the connection and can use them in Relay requests. Ungranted principals do not receive those Models in their usable candidate set.

Verification

Authenticate as the granted principal. Send one controlled request. Confirm the provider connection, Model, user, and optional exact-key attribution in Relay → Logs. Confirm that an ungranted principal cannot use the connection.

Recovery

If the Model remains hidden, confirm relay:request, the grant target, active connection state, and Model enablement. If access is too broad, revoke the grant and create a narrower exact-key or user grant.

Organization connection managers can see sanitized management data. They do not receive provider secrets.

Next

Self-host Relay from source.