Subscription Provider Sign-in

Open deek.loca.zone, complete Authelia, and choose Settings → Models. At the 2026-10-29 pxl-canary readback, Settings displayed 0.2.1-rc.2; supplied release custody identified that instance as rc.2-r14, not a UI-displayed r14 suffix. Six shared-subscription cards were visible: ChatGPT/Codex, Claude Pro/Max, xAI Grok, Z.ai Chinese coding-plan, Google subscription, and Meta Muse subscription. Other owners can run different releases or configurations; see Releases. Card visibility did not establish sign-in authorization, entitlement, refresh, quota, or successful inference.

Phone observation, not a new verification: at that same 2026-10-29 rc.2-r14 readback, the Settings → Models overview fit 390 × 844, its section navigation and provider names wrapped, visible Edit buttons stayed contained, and the content scrolled vertically. Provider-edit dialogs, other viewport widths, physical-device input, and other owner releases were not exercised. An earlier staged responsive CSS proposal was not promoted because its final fair startup-error comparison failed; that historical proposal result is not the current phone-layout verdict.

Before you start

Authelia selects your private provisioned Deek instance; its browser session alone does not create provider entitlement. Accounts without an instance receive403 rather than loca’s conversations. Approved onboarding remains limited to DeepSeek, ChatGPT/Codex, and Claude, with independent provider-specific permission. Native DeepSeek-account sign-in is an optional prepaid-credit route, not permission to provision a paid API key. Google/Antigravity and the other visible providers are outside this approved onboarding guide. No operator OMP/Hermes wallet is read or copied; paid API-key provisioning, .env secrets, and wallet imports remain unauthorized. A visible card or saved model never widens this policy.

Published owner deployment history records explicitly chosen shared subscription access for pxl and otto, with the providers’ no-sharing/terms and shared-quota risks accepted for that scope. It describes separate local bearers through fixed root-owned loopback proxies, with OAuth grants and refresh retained only in the existing Deek holder. Sharing models does not share conversations, workspaces, browser signers, plugin settings, or future provider permissions. This documentation repair did not inspect those stores or renew any permission.

pxl and otto: no extra provider login

Sign into Deek with your own Authelia account. The owner/release-specific Models rows identify shared access; the 2026-10-29 pxl readback said shared subscription, while earlier owner guidance used shared loca. Shared-instance onboarding does not require another provider-vault login or receipt of the operator’s tokens. Do not repeat a completed login. Choose Configure later on a generic API-key notice rather than adding a paid key. The documented operator can revoke a local model proxy independently of the holder.

The earlier pxl/otto settings/catalog readback recorded deek-claude / anthropic/claude-haiku-4-5 as the advertised default; this is not a new check of any owner’s saved model. No DeepSeek API key is supplied or needed. Historical one-word Haiku4.5 proofs were separately authorized and archived; those allowances are spent. Any new model selection or inference needs its own provider-specific permission, and another inference check needs a new explicit go.

The sign-in commands below are historical, owner-specific recovery references for loca’s dedicated d495 holder, not universal onboarding or verified current pxl/otto paths. Before future expiry/revocation recovery, the deployment owner must establish the applicable release, wrapper, account, and consent. Do not execute them merely because a card is visible. The recorded wrapper disables automatic browser opening, refuses an occupied callback instead of killing another flow, and offers a credential-only --check that starts neither OAuth nor inference. No recovery command was exercised in this documentation repair.

Delegated Codex/Claude/OMP command-line stores remain separate; the shared parent Models routes do not silently populate them.

See Private Accounts and Service Publishing for data separation, owner-only app URLs and the deployment tool.

Historical loca-holder recovery references

ChatGPT / Codex subscription

ssh -tt -o ExitOnForwardFailure=yes -L localhost:1455:127.0.0.1:1455 loca.zone-loca 'sudo -n /opt/deek/d495-tools/sign-in openai-codex'

Expected user flow [INFERENCE from the pinned OMP implementation; not exercised by the deployment owner]: OMP prints an OpenAI authorization URL. Open it yourself, choose your ChatGPT/Codex account, and consent. Keep SSH running so the Mac’s localhost:1455 callback reaches the fresh holder. If the native prompt requests a pasted redirect, paste it only into that prompt, never into chat or a receipt.

Claude Pro / Max subscription

ssh -tt -o ExitOnForwardFailure=yes -L localhost:54545:127.0.0.1:54545 loca.zone-loca 'sudo -n /opt/deek/d495-tools/sign-in anthropic'

Expected user flow [INFERENCE]: OMP prints Anthropic’s authorization URL and a native completion prompt. Open the URL yourself, choose the entitled Claude account, and complete the prompt. Keep the callback tunnel open. This is the anthropic subscription flow, not an Anthropic Console paid API key.

xAI Grok subscription

This retained xAI recovery flow records older owner-specific deployment history. It is outside the approved DeepSeek/Codex/Claude onboarding scope and grants no new sign-in or inference permission.

ssh -tt loca.zone-loca 'sudo -n /opt/deek/d495-tools/sign-in xai-oauth'

Expected user flow [INFERENCE]: OMP prints a device-verification URL and a one-time code. Open the URL yourself, enter the code, and approve the intended Grok account while SSH waits. No callback port is required. Use xai-oauth, not the paid API-key provider xai.

After sign-in

Tell the deployment owner which provider finished, without sending credentials or a callback URL. The owner can validate identity/status, list entitled models, and check token-refresh metadata without making a model request. Successful sign-in is not proof of plan entitlement, available quota, a successful refresh, or inference. One cheap model request per provider requires your separate explicit authorization; no automatic model test, retry, or fallback runs.

Reload Settings → Models only to inspect the relevant subscription card and model picker. The local bearer authenticates Deek to the holder; it does not create provider authorization. An advertised catalog is not entitlement or inference proof. Actual account/plan errors must remain visible rather than being replaced with another provider.

The private authorization reference explains custody and revocation. Troubleshooting covers callback and native startup errors. OMP ACP child credentials and the blocked Hermes installation remain separate in OMP and Hermes.