> ## Documentation Index
> Fetch the complete documentation index at: https://gateway.consus.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Factory

> Use Factory (droid) with ITAR and FedRAMP High data. Sign in with your company account; there is no API key to handle.

> [!WARNING]
>
> The gateway enforces the compliance boundary for the models it serves, but it does **not** control client-side behavior — local tool execution, file access, outbound destinations, etc. Client-side behavior is the customer's responsibility.

Factory's custom models ("BYOK") point droid at the Consus Gateway. Instead of pasting an API key, each developer installs a small **credential helper** once. The first time droid needs a credential, the helper opens a browser tab to the Consus portal. You sign in with your company account, and the helper receives a key issued to you. Nobody sees or copies a key, and IT has nothing to push to your computer.

## Before you start

You need:

* **Factory installed.** See the [Factory docs](https://docs.factory.ai) if you don't have it yet.
* **Access to the Consus portal** through your organization's SSO. Ask your Consus admin if `portal.consus.io` doesn't recognize your account.

## Step 1: Install the credential helper

One command, no admin rights. It places a single shell script at `~/.consus/helper.sh`. The helper is the same for every tool; [Enterprise SSO sign-in](/credential-helper) covers it in full.

**macOS / Linux / WSL**

```bash theme={null}
curl -fsSL https://portal.consus.io/cli/install.sh | sh
```

**Windows (PowerShell)**

```powershell theme={null}
New-Item -ItemType Directory -Force "$HOME\.consus" | Out-Null
Invoke-WebRequest https://portal.consus.io/cli/helper.ps1 -OutFile "$HOME\.consus\helper.ps1"
```

The helper is plain, readable source (`helper.sh` is POSIX shell; `helper.ps1` is PowerShell). It talks only to `portal.consus.io` and stores the key it receives in `~/.consus/key`, readable by your user only.

## Step 2: Point Factory at the gateway

Open `~/.factory/settings.json` and add the Consus models under `customModels`. Set `apiKeyHelper` to the helper, not to a key.

**macOS / Linux / WSL**

```json theme={null}
{
  "customModels": [
    {
      "model": "claude-opus-5-5:fedramp-high",
      "displayName": "Consus Opus 5.5 (FedRAMP High)",
      "baseUrl": "https://api.consus.io",
      "provider": "anthropic",
      "maxOutputTokens": 64000,
      "maxContextLimit": 1000000,
      "apiKeyHelper": "sh ~/.consus/helper.sh --tool factory",
      "apiKeyHelperTtlMs": 60000
    },
    {
      "model": "claude-sonnet-5-5:fedramp-high",
      "displayName": "Consus Sonnet 5.5 (FedRAMP High)",
      "baseUrl": "https://api.consus.io",
      "provider": "anthropic",
      "maxOutputTokens": 64000,
      "maxContextLimit": 1000000,
      "apiKeyHelper": "sh ~/.consus/helper.sh --tool factory",
      "apiKeyHelperTtlMs": 60000
    },
    {
      "model": "gpt-5.6-luna:fedramp-high",
      "displayName": "Consus GPT-5.6 Luna (FedRAMP High)",
      "baseUrl": "https://api.consus.io/v1",
      "provider": "openai",
      "maxOutputTokens": 64000,
      "maxContextLimit": 1000000,
      "apiKeyHelper": "sh ~/.consus/helper.sh --tool factory",
      "apiKeyHelperTtlMs": 60000
    }
  ]
}
```

**Windows**

Same entries, with the PowerShell helper as the command (replace `<you>` with your Windows username):

```json theme={null}
"apiKeyHelper": "powershell -NoProfile -ExecutionPolicy Bypass -File C:\\Users\\<you>\\.consus\\helper.ps1 --tool factory"
```

Notes:

* **Compliance level.** The `:fedramp-high` suffix picks the authorization boundary. Use `:itar` for ITAR / export-controlled work. Don't mix levels in one session. See [Models](/models) for every ID and level.
* **Provider.** Claude models use `"provider": "anthropic"` with the bare base URL. OpenAI and Gemini models use `"provider": "openai"` with `https://api.consus.io/v1`.
* **Helper refresh.** `apiKeyHelperTtlMs` is how often Factory re-runs the helper (default five minutes). One minute means a key revoked in the portal stops working within a minute; with a key present each run takes milliseconds and makes no network call.
* **Organization-wide.** A Factory org admin can push these same `customModels` through Factory's org-managed settings so nobody edits a file. Factory refuses static `apiKey` values in org-managed models and expects exactly this `apiKeyHelper` form. The org's model policy must allow custom models.
* **Personal or org-managed settings only.** Factory ignores `apiKeyHelper` in project-level settings and in a `--settings` file passed on the command line; put it in `~/.factory/settings.json` or the org-managed settings.

## Step 3: Sign in

Start droid and send any prompt on a Consus model. Your browser opens to the Consus portal:

1. Sign in with your company account (your organization's SSO, plus the portal's security-key or passkey check).
2. The page shows the tool and the computer asking for access, for example *Factory on eric-mbp*. Only approve a request you just started on your own computer.
3. Click **Approve**. You can close the tab; droid continues on its own.

The helper keeps the key for next time, so this happens once per computer. Factory re-runs the helper every few minutes; while a key is present that takes milliseconds and makes no network call.

If droid reports `Failed to obtain an API key from the configured apiKeyHelper command` on that first prompt, the sign-in simply hadn't finished yet. Complete it in the browser and send the prompt again. You can also sign in ahead of time:

```bash theme={null}
sh ~/.consus/helper.sh login
```

## Verify

```bash theme={null}
sh ~/.consus/helper.sh status
```

shows who is signed in, the organization, and the key's expiry. In droid, `/model` lists the Consus entries. For scripts, custom models are addressed by an ID Factory builds from the display name, `custom:<display-name-with-dashes>-0`, for example:

```bash theme={null}
droid exec -m "custom:Consus-Sonnet-5.5-(FedRAMP-High)-0" "say hello"
```

If you get the ID wrong, droid's `Invalid model` message lists the exact IDs it knows.

## Sign out or switch accounts

* `sh ~/.consus/helper.sh logout` forgets the key on this computer. The next prompt signs in again.
* To disable the key everywhere (lost laptop, someone leaving), revoke it in the Consus portal under your keys. It is labeled `factory - <computer name>`. Admins can revoke any key in their organization.

## Troubleshooting

| What you see | Why | What to do |
| :- | :- | :- |
| `Failed to obtain an API key from the configured apiKeyHelper command` | You hadn't finished signing in, or the helper isn't at the path in `apiKeyHelper` | Finish signing in and send the prompt again, or run `sh ~/.consus/helper.sh login`. Check the path with `ls ~/.consus/helper.sh` |
| `403 Forbidden` from the gateway | The key was revoked or has expired. Factory keeps sending its last key until `apiKeyHelperTtlMs` passes | Run `sh ~/.consus/helper.sh logout`, wait for the TTL (one minute with the settings above), then send a prompt to sign in again |
| `Invalid model: …` from `droid exec -m` | Custom models aren't selected by their `model` field | Use the `custom:…-0` form shown under **Verify** |
| The browser never opens (SSH session, container) | There is no desktop to open it on | The helper prints the sign-in link instead. Open it on any device, then try again |
| Factory says custom models aren't allowed | Your org's Factory model policy | Ask your Factory org admin to allow custom models |

## What the helper does and doesn't do

See [Enterprise SSO sign-in](/credential-helper): what it stores, what it talks to, and how revocation works. In short, it talks only to `portal.consus.io`, keeps the key in `~/.consus/key` with user-only permissions, never prints anything but the key, and contains no secrets of its own.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.