Cloud Proxy

The Cloud Proxy is the Flowstate-hosted forward proxy at proxy.flowstate.inc. The Flowstate Agent on each device routes AI tool traffic through it. The proxy authenticates each device, attributes the traffic to the right person, and feeds sessions and spend into your Flowstate tenant.

Devices authenticate with a short-lived signed token minted from the user's email and your org-wide Cloud Proxy key. One key serves the whole fleet. Attribution happens in the backend: the proxy meters traffic by subject (the person or AI service account behind it) without a key per engineer.

The Cloud Proxy page

Settings → AI → Cloud Proxy gives admins three surfaces:

Surface	What it does
Self-install (device flow)	The user installs the agent and signs in. The device flow handles authentication. There is no key to copy. Links to the self-install guide.
MDM / managed fleet	One button generates a macOS .mobileconfig with the org token embedded and the user email left as the MDM $EMAIL placeholder. The token is revealed once, next to the download.
Custom AI-service hostnames	Add private or custom provider domains (a custom Azure OpenAI endpoint, a private host) the proxy should cover for your organisation. Standard provider hosts are always covered. Changes reach the fleet within about 5 minutes.

There is no key-rotation button. Rotation follows the runbook at Key rotation.

Where the data appears

• Sessions: Insights → Agent insights → Agent sessions (/plan/main/insights/agents/sessions).
• Spend and dashboards: Insights → Agent insights → Dashboard and Spend insights.
• Each person's own usage: My AI → My sessions.

Quickstart

1. Open Settings → AI → Cloud Proxy.
2. Pick a rollout path:
   • Self-install. Send users the self-install guide. Each user installs the agent and approves the sign-in prompt in their browser. No key handling.
   • MDM. Click Generate MDM profile, then deploy the downloaded .mobileconfig through your MDM. The org token is embedded; the user email expands per device.
3. Use any AI tool on an onboarded device, then confirm sessions at Insights → Agent insights → Agent sessions within a few minutes.

For per-OS install detail, see the agent install pages: macOS, Windows, Linux.

Where to go next

• Install the cloud proxy: both rollout paths, step by step.
• Troubleshooting: sign-in, MDM delivery, and missing sessions.
• Security and privacy: what the Cloud Proxy stores and what it does not.
• Flowstate Agent: the on-device agent that does the capture.