Factory

The gateway enforces the compliance boundary for the models it serves, but it does not control client-side behavior — local tool execution, file access, outbound destinations, etc. Client-side behavior is the customer’s responsibility.

Factory’s custom models (“BYOK”) point droid at the Consus Gateway. Instead of pasting an API key, each developer installs a small credential helper once. The first time droid needs a credential, the helper opens a browser tab to the Consus portal. You sign in with your company account, and the helper receives a key issued to you. Nobody sees or copies a key, and IT has nothing to push to your computer.

Before you start

You need:

Factory installed. See the Factory docs if you don’t have it yet.
Access to the Consus portal through your organization’s SSO. Ask your Consus admin if portal.consus.io doesn’t recognize your account.

Step 1: Install the credential helper

One command, no admin rights. It places a single shell script at ~/.consus/helper.sh. The helper is the same for every tool; Enterprise SSO sign-in covers it in full.

macOS / Linux / WSL
Windows (PowerShell)

curl -fsSL https://portal.consus.io/cli/install.sh | sh

New-Item -ItemType Directory -Force "$HOME\.consus" | Out-Null
Invoke-WebRequest https://portal.consus.io/cli/helper.ps1 -OutFile "$HOME\.consus\helper.ps1"

The helper is plain, readable source (helper.sh is POSIX shell; helper.ps1 is PowerShell). It talks only to portal.consus.io and stores the key it receives in ~/.consus/key, readable by your user only.

Step 2: Point Factory at the gateway

Open ~/.factory/settings.json and add the Consus models under customModels. Set apiKeyHelper to the helper, not to a key.

macOS / Linux / WSL
Windows

{
  "customModels": [
    {
      "model": "claude-opus-5-5:fedramp-high",
      "displayName": "Consus Opus 5.5 (FedRAMP High)",
      "baseUrl": "https://api.consus.io",
      "provider": "anthropic",
      "maxOutputTokens": 64000,
      "maxContextLimit": 1000000,
      "apiKeyHelper": "sh ~/.consus/helper.sh --tool factory",
      "apiKeyHelperTtlMs": 60000
    },
    {
      "model": "claude-sonnet-5-5:fedramp-high",
      "displayName": "Consus Sonnet 5.5 (FedRAMP High)",
      "baseUrl": "https://api.consus.io",
      "provider": "anthropic",
      "maxOutputTokens": 64000,
      "maxContextLimit": 1000000,
      "apiKeyHelper": "sh ~/.consus/helper.sh --tool factory",
      "apiKeyHelperTtlMs": 60000
    },
    {
      "model": "gpt-5.6-luna:fedramp-high",
      "displayName": "Consus GPT-5.6 Luna (FedRAMP High)",
      "baseUrl": "https://api.consus.io/v1",
      "provider": "openai",
      "maxOutputTokens": 64000,
      "maxContextLimit": 1000000,
      "apiKeyHelper": "sh ~/.consus/helper.sh --tool factory",
      "apiKeyHelperTtlMs": 60000
    }
  ]
}

Same entries, with the PowerShell helper as the command (replace <you> with your Windows username):

"apiKeyHelper": "powershell -NoProfile -ExecutionPolicy Bypass -File C:\\Users\\<you>\\.consus\\helper.ps1 --tool factory"

Notes:

Compliance level. The :fedramp-high suffix picks the authorization boundary. Use :itar for ITAR / export-controlled work. Don’t mix levels in one session. See Models for every ID and level.
Provider. Claude models use "provider": "anthropic" with the bare base URL. OpenAI and Gemini models use "provider": "openai" with https://api.consus.io/v1.
Helper refresh. apiKeyHelperTtlMs is how often Factory re-runs the helper (default five minutes). One minute means a key revoked in the portal stops working within a minute; with a key present each run takes milliseconds and makes no network call.
Organization-wide. A Factory org admin can push these same customModels through Factory’s org-managed settings so nobody edits a file. Factory refuses static apiKey values in org-managed models and expects exactly this apiKeyHelper form. The org’s model policy must allow custom models.
Personal or org-managed settings only. Factory ignores apiKeyHelper in project-level settings and in a --settings file passed on the command line; put it in ~/.factory/settings.json or the org-managed settings.

Start droid and send any prompt on a Consus model. Your browser opens to the Consus portal:

Sign in with your company account (your organization’s SSO, plus the portal’s security-key or passkey check).
The page shows the tool and the computer asking for access, for example Factory on eric-mbp. Only approve a request you just started on your own computer.
Click Approve. You can close the tab; droid continues on its own.

The helper keeps the key for next time, so this happens once per computer. Factory re-runs the helper every few minutes; while a key is present that takes milliseconds and makes no network call. If droid reports Failed to obtain an API key from the configured apiKeyHelper command on that first prompt, the sign-in simply hadn’t finished yet. Complete it in the browser and send the prompt again. You can also sign in ahead of time:

sh ~/.consus/helper.sh login

Verify

sh ~/.consus/helper.sh status

shows who is signed in, the organization, and the key’s expiry. In droid, /model lists the Consus entries. For scripts, custom models are addressed by an ID Factory builds from the display name, custom:<display-name-with-dashes>-0, for example:

droid exec -m "custom:Consus-Sonnet-5.5-(FedRAMP-High)-0" "say hello"

If you get the ID wrong, droid’s Invalid model message lists the exact IDs it knows.

Sign out or switch accounts

sh ~/.consus/helper.sh logout forgets the key on this computer. The next prompt signs in again.
To disable the key everywhere (lost laptop, someone leaving), revoke it in the Consus portal under your keys. It is labeled factory - <computer name>. Admins can revoke any key in their organization.

Troubleshooting

What you see	Why	What to do
`Failed to obtain an API key from the configured apiKeyHelper command`	You hadn’t finished signing in, or the helper isn’t at the path in `apiKeyHelper`	Finish signing in and send the prompt again, or run `sh ~/.consus/helper.sh login`. Check the path with `ls ~/.consus/helper.sh`
`403 Forbidden` from the gateway	The key was revoked or has expired. Factory keeps sending its last key until `apiKeyHelperTtlMs` passes	Run `sh ~/.consus/helper.sh logout`, wait for the TTL (one minute with the settings above), then send a prompt to sign in again
`Invalid model: …` from `droid exec -m`	Custom models aren’t selected by their `model` field	Use the `custom:…-0` form shown under Verify
The browser never opens (SSH session, container)	There is no desktop to open it on	The helper prints the sign-in link instead. Open it on any device, then try again
Factory says custom models aren’t allowed	Your org’s Factory model policy	Ask your Factory org admin to allow custom models

What the helper does and doesn’t do

See Enterprise SSO sign-in: what it stores, what it talks to, and how revocation works. In short, it talks only to portal.consus.io, keeps the key in ~/.consus/key with user-only permissions, never prints anything but the key, and contains no secrets of its own.

Product

Getting Started

API Reference

Integrations

Before you start

Step 1: Install the credential helper

Step 2: Point Factory at the gateway

Verify

Sign out or switch accounts

Troubleshooting

What the helper does and doesn’t do

​Before you start

​Step 1: Install the credential helper

​Step 2: Point Factory at the gateway

​Step 3: Sign in

​Verify

​Sign out or switch accounts

​Troubleshooting

​What the helper does and doesn’t do

Before you start

Step 1: Install the credential helper

Step 2: Point Factory at the gateway

Step 3: Sign in

Verify

Sign out or switch accounts

Troubleshooting

What the helper does and doesn’t do