Not all authentication methods are created equal. Before you build, understand what your subscription actually allows — and where you must switch to API keys. The rules differ significantly across vendors and deployment scenarios.
A single developer or a company building an internal tool — a script, a Make.com/n8n workflow, a Slack bot, a web app, a cron job — that calls an AI coding CLI programmatically via its official headless mode (claude -p, codex exec, gemini -p). The tool is for personal use or company employees only — not sold externally.
| Environment | Claude Code | Codex CLI (OpenAI) | Gemini CLI | GitHub Copilot CLI |
|---|---|---|---|---|
| Script / daemon / cron on own machine | ✅ API Key · ✅ Subscription | ✅ API Key · ✅ Subscription | ✅ API Key · ✅ Subscription | ✅ BYOK · ✅ Subscription |
| Own VPS | ✅ API Key · ✅ Subscription — No ToS ban on where you run the official CLI. Auth needs periodic browser refresh | ✅ API Key · ✅ Subscription — Device code flow (codex login --device-auth) enables headless auth. Officially documented |
✅ API Key · ⚠️ Subscription — Google account login requires a browser; cached credentials work in -p mode after initial login, but headless mode cannot initiate a fresh Google login |
✅ BYOK · ⚠️ Subscription — Device code flow (RFC 8628) works but may need workspace admin approval |
| Each user has own CLI + own subscription; internal app triggers their local CLI | ✅ API Key · ✅ Subscription — Each person uses their own seat, their own CLI. Standard usage | ✅ API Key · ✅ Subscription — Each person uses their own Codex via exec. Standard usage |
✅ API Key · ✅ Subscription — Each person uses their own Gemini CLI via -p. Standard usage |
✅ BYOK · ✅ Subscription — Each person uses their own Copilot license |
| Centralized server, one subscription, multiple users | ✅ API Key · ❌ Subscription — One subscription serving multiple users violates terms. OAuth is for that user's own CLI usage, not a shared backend | ✅ API Key · ❌ Subscription — One sub = one user. A single subscription cannot serve multiple people through a shared backend | ✅ API Key · ✅ Vertex AI · ❌ Subscription — Google account auth is per-individual. Cannot share across multiple users | ✅ BYOK · ❌ Subscription — Per-user licensing. Each user needs their own Copilot license |
| CI/CD pipeline (own repos) | ✅ API Key · ✅ Subscription — Anthropic docs show GitHub Actions with subscription auth | ✅ API Key · ✅ Subscription — Official CI/CD examples in docs | ✅ API Key · ✅ Vertex AI · ✅ Subscription — Headless mode with cached credentials or service account | ✅ BYOK · ✅ Subscription — Developer running the pipeline uses their own license |
You're building a product or service for external customers — a SaaS tool, a client-facing automation, a white-label solution — that calls an AI coding CLI programmatically on a server. End users are outside your organization.
| Environment | Claude Code | Codex CLI (OpenAI) | Gemini CLI | GitHub Copilot CLI |
|---|---|---|---|---|
| Backend service powering a product | ✅ API Key — Commercial Terms: "permission to power products for its own customers and end users" · ❌ Subscription — Consumer ToS: "ordinary, individual usage" only. Enforced Jan 2026 | ✅ API Key — Standard API terms allow building products · ❌ Subscription — One sub = one user. Cannot power a product serving external customers | ✅ API Key · ✅ Vertex AI — CLI is Apache 2.0 OSS. Pay-per-token, no per-user restriction · ❌ Subscription — Not designed for powering external products | ✅ BYOK — Bypasses Copilot licensing entirely · ❌ Subscription — Cannot use one subscription to serve external customers |
| Multi-tenant SaaS | ✅ API Key · ❌ Subscription | ✅ API Key · ❌ Subscription | ✅ API Key · ✅ Vertex AI · ❌ Subscription | ✅ BYOK · ❌ Subscription |
| Own subscription in a third-party coding tool | ❌ Subscription — Feb 2026: "OAuth is intended exclusively for Claude Code and Claude.ai. Using OAuth tokens in any other product, tool, or service is not permitted" · ✅ API Key | ✅ Subscription — OpenAI actively endorses third-party harness use. Hired OpenClaw creator. Published embedding guides · ✅ API Key | ❌ Subscription — Google FAQ: "Using third-party software, tools, or services to access Gemini CLI is a violation" · ✅ API Key · ✅ Vertex AI | ✅ Copilot SDK (public preview) — Designed for embedding · ✅ BYOK · ⚠️ Subscription — Users need their own Copilot license |
| Scenario | Claude Code | Codex CLI | Gemini CLI | Copilot CLI |
|---|---|---|---|---|
| Own machine, own scripts | ✅ | ✅ | ✅ | ✅ |
| Own VPS | ✅ | ✅ | ⚠️ needs cached auth | ⚠️ device code flow |
| Each user on own seat, app triggers their local CLI | ✅ | ✅ | ✅ | ✅ |
| Centralized server, one sub, multiple users | ❌ | ❌ | ❌ | ❌ |
| CI/CD for own repos | ✅ | ✅ | ✅ | ✅ |
| Powering an external product | ❌ | ❌ | ❌ | ❌ |
| Own sub in a third-party coding tool | ❌ | ✅ | ❌ | ✅ |