Appearance
Usage providers
Where the bills come from. This is where an admin connects each AI provider's billing API so Flowstate can pull authoritative usage and spend, distinct from the device-side telemetry the Flowstate Agent collects.
Connections are made from the Integrations marketplace at Settings → Integrations (/settings/integrations). Open a provider's tile, pick how you want to connect, and follow the steps.
Why both telemetry and billing pulls
Telemetry from the agent gives you per-session detail with prompt-level granularity. Billing pulls give you the provider's authoritative number — the one you actually pay against. They rarely match exactly. The Spend reconciliation screen is what bridges them.
Without a billing pull, you can still see telemetry-side spend in Attribution, but the reconciliation surface won't have an invoice side to match against.
What's connectable
Every tile in the marketplace is one Flowstate can actually finish connecting — there are no placeholder or coming-soon entries. A provider earns a tile only when its API returns cost or usage over a date range and Flowstate has a working client for it.
Providers differ enormously in what they will tell you, and that difference matters more than the setup effort. A few report money and people on the same row; most report only money, at the account level.
The four columns below are the same capability ticks each route shows on its own page, so what you read here is what you'll see on screen.
| Provider | Credentials needed | Invoiced cost | Token usage | Per person | Per project |
|---|---|---|---|---|---|
| Anthropic API (Console) | Admin key (sk-ant-admin…), created by an org admin | ✓ | ✓ | ✓ | — |
| Claude Enterprise | Analytics key (read:analytics), created by the primary owner | ✓ | ✓ | ✓ | — |
| OpenAI Platform API | Admin key, created by an organisation owner | ✓ | ✓ | ✓ | ✓ |
| GitHub Copilot | PAT with read:org, plus the organisation slug | ✓ | — | ✓ | — |
| Cursor | Team admin key (key_…) from the Cursor dashboard | ✓ | — | ✓ | — |
| Windsurf | Teams read-only service key | — | — | ✓ | — |
| Gemini API | GCP Workload Identity Federation + billing export table | ✓ | — | — | — |
| Vertex AI | GCP Workload Identity Federation + billing export table | ✓ | — | — | — |
| Azure OpenAI | Entra federated credential + Cost Management Reader | ✓ | — | — | — |
| Amazon Bedrock | IAM role allowing ce:GetCostAndUsage | ✓ | — | — | — |
| Mistral | Admin key from backoffice.mistral.ai (Enterprise) | ✓ | — | — | — |
| Fireworks AI | Account API key + account id | ✓ | — | — | — |
| ElevenLabs | Workspace service-account key | ✓ | — | — | — |
| Intercom Fin | Private-app access token + your price per resolution | — | — | — | — |
| Demo | None — generates synthetic data for evaluation | ✓ | ✓ | ✓ | — |
Windsurf and Intercom Fin show no tick under Invoiced cost on purpose. Both still produce a spend figure, but it is Flowstate's arithmetic rather than the provider's invoice: Windsurf reports credits which we value at list price, and Intercom reports resolutions which we multiply by the rate you enter. Both appear as estimated cost, and neither will tie exactly to a negotiated contract.
The Demo provider is useful for evaluating Flowstate before you've wired anything real. It seeds plausible usage and telemetry so the dashboards have something to render. Don't enable it in production — its data is clearly labelled but it pollutes the org's reconciliation queue.
Connecting a provider
- Open Settings → Integrations and select the provider's tile.
- Pick a route — the documented way to get spend out of that provider. Every provider has exactly one today, marked Recommended, with the capability ticks and rough setup time shown up front so you know what you are getting before you start. Where a provider grows a second route, the recommended one is listed first and taking it is always a safe default.
- Follow the numbered steps to create the credential at the provider, then paste it in.
- Click Verify and connect.
Claude is the case that looks like two routes but isn't: the Anthropic Console API and Claude Enterprise are separate tiles with separate key types, because they are separate products with separate bills. Connect whichever you buy, or both.
Flowstate makes one read-only call to the provider before saving anything. If the credential is wrong you get the provider's own error message inline, your typed key stays in the box, and no connection is created. If it works, the connection is saved and a background backfill starts immediately.
There is no separate "Test" button. There used to be, and it was a trap: testing quietly created a connection, so testing and then saving left you with two. Connecting now always validates first, which is what a test was for.
Watching the first import
Connecting starts a backfill immediately, and the provider page shows how far it has got rather than leaving you guessing: Key verified, Importing spend history, Matching provider users to your people, Attributing spend to teams, then Ready to report on. A provider with no per-person data skips the matching stage rather than showing it stuck.
If the import stops — usually a credential that stopped working mid-backfill — the band says so instead of sitting at a percentage forever.
Replacing a key, renaming, disconnecting
Each connection row carries Sync now, Replace key, Rename connection and Disconnect.
Replace key is what you want after a key expires, is revoked, or the person who created it leaves. It pastes a new credential onto the existing connection and keeps the history. Disconnecting and reconnecting works too, but it is the long way round.
WARNING
Disconnecting a provider stops the billing pull. Existing historical data is retained, but spend reconciliation for periods after the disconnection shows all observed spend as residual variance until you reconnect (or write off the period).
When something breaks
A connection shows its real state, not a green tick. Each row carries its status and how far the data actually reaches — Data through a date, or No data yet — so a connection that authenticated fine but has imported nothing is distinguishable from one that is working.
If a provider starts refusing the credential, the row carries the provider's own error and the status says why: an authentication failure and an exhausted quota look different because they need different fixes.
A sync that returns no rows is recorded as a warning rather than as silent success, so "no spend this week" and "we stopped being able to see your spend" are never confused for one another.
What this isn't
This page is not Detected services. That list is read-only and discovery-driven — it shows every AI service the org talks to, including ones Flowstate has never been given billing credentials for. This page is the credential surface specifically.
It's also not where you manage the Cloud Proxy key — that credential identifies on-device traffic and is managed separately under Settings → AI → Cloud Proxy.