Provider offerings and subscription boundaries
v0.9.0 provides Kimi Code and an explicitly operator-enabled Claude subscription as separate Provider Offerings. An Offering identifies the product and balance; a Profile identifies its invocation protocol. Sharing a vendor, host, or protocol does not make credentials interchangeable. Setup still follows Credential → Provider → Deployment → Route → Project → Gateway Key.
Released product boundaries
Section titled “Released product boundaries”| Product | v0.9.1 behavior | Setup boundary |
|---|---|---|
| Kimi Code | Offers kimi.code.openai.chat.v1 and kimi.code.anthropic.messages.v1 with a dedicated Kimi Code credential | Separate from metered Kimi API; choose the exact product and acknowledge its usage notice |
| Claude subscription | anthropic.subscription.messages.v1 is disabled for creation by default and requires an explicit switch | Separate OAuth JSON Credential; do not use a metered Anthropic API key |
| MiniMax Subscription Access | Mainland/global OpenAI Chat Profiles are creatable; Anthropic subscription Profiles remain withheld at this tag | Verify capabilities, models, and region against this Profile, not current main |
| OpenAI Codex subscription | No configurable product in this release | An ordinary OpenAI API Provider is not a Codex subscription entry point |
A contract entry does not imply availability. The synchronized API matrix distinguishes withheld Profiles from subscriptions disabled by default. Model enumeration establishes identifiers only; capability evidence still comes from the catalog, declarations, or detection.
Claude subscription switch and credentials
Section titled “Claude subscription switch and credentials”Merge this fragment into a complete configuration, validate, and restart:
provider_subscriptions: anthropic_claude: trueThe default is false. Halro limits the intended use of this path to development and debugging in an instance
used solely by the subscription holder; the supported production choice remains a metered API with separate
billing. Enabling the switch and acknowledging the notice do not change upstream permissions. This describes
the release’s product boundary, not an interpretation of upstream terms.
The Credential stores access/refresh-token JSON and retains the document’s expiry in its durable record. Use the dedicated Admin credential flow; keep OAuth documents out of YAML, shell history, screenshots, and logs. This Profile has not been granted Files, Batches, or Provider-executed tool capabilities. Do not infer them from the metered Anthropic Profile.
Setup and acceptance sequence
Section titled “Setup and acceptance sequence”- Choose the exact product, access surface, and Profile in Providers, then create a matching Credential. Check the region and product purpose.
- Refresh identifiers from the available upstream model list and verify Deployment capability evidence and pricing. Unknown capabilities must not be treated as supported.
- Create a public alias, authorize the Project, and mint a Gateway Key with minimal scopes. Subscription balance does not automatically supply per-token prices: use an explicit Price Version. Unknown pricing remains subject to instance policy and budget restrictions.
- Run capability detection or a workbench request only within the actual authorization; this may spend subscription allowance or incur fees. Inspect Usage, returned model, Credential revision, and route suspensions. HTTP 200 alone is insufficient acceptance.
For the complete first setup, see Admin Console setup.