feat(quickstart): add subscription auth modes

README.md

@@ -109,20 +109,30 @@ One TOML file at `~/.zeroclaw/config.toml`. Pointers:
 
 A V3 config has at minimum four section headers (`<type>.<alias>` shaped) — a provider entry, an agent that references it, and a risk profile the agent gates against. See [Provider Configuration → Minimal working example](docs/book/src/providers/configuration.md#minimal-working-example) for the canonical four-section form with inline type/alias commentary.
 
-For standard OpenAI Codex subscription auth, swap the provider entry to:
+For standard OpenAI Codex subscription auth, Quickstart can write the provider
+entry for you:
+
+```bash
+zeroclaw auth login --model-provider openai-codex --import ~/.codex/auth.json  # if already signed in with Codex CLI
+zeroclaw quickstart --model-provider openai-codex --model gpt-5.4
+```
+
+The provider entry uses the canonical OpenAI shape; the alias below is an
+example:
 
 ```toml
 [providers.models.openai.coding]   # type = openai; alias = coding (you choose)
-model = "gpt-5-codex"
+model = "gpt-5.4"
 wire_api = "responses"
 requires_openai_auth = true
 ```
 
-…and point your agent at it with `model_provider = "openai.coding"`.
+…and point your agent at it with `model_provider = "openai.<alias>"`.
 
 Notes:
 
 - Normal OpenAI Codex subscription auth uses stored auth profiles, not an `api_key` on the provider entry.
+- Claude Max setup-token auth stays on the canonical Anthropic slot: run `claude setup-token`, choose `setup_token` in Quickstart, and paste the generated token into the API key/token prompt.
 - Only set `api_key` / `uri` on `[providers.models.openai.<alias>]` when intentionally targeting a custom OpenAI-compatible gateway or endpoint.
 - If you see `provider streaming failed, falling back to non-streaming chat`, ZeroClaw retries the same request in non-streaming mode. Check `zeroclaw auth status` before changing provider config.
 

crates/zeroclaw-config/src/schema.rs

@@ -813,7 +813,7 @@ pub struct ModelProviderConfig {
     #[tab(Advanced)]
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub wire_api: Option<WireApi>,
-    /// When true, the client pulls credentials from `OPENAI_API_KEY` or `~/.codex/auth.json` instead of the `api_key` field above. Turn on only for the OpenAI Codex model_provider; leave off for standard API-key model_providers.
+    /// When true, the client pulls credentials from ZeroClaw's stored `openai-codex` auth profile instead of the `api_key` field above. Import an existing Codex CLI login with `zeroclaw auth login --model-provider openai-codex --import ~/.codex/auth.json`, or run `zeroclaw auth login --model-provider openai-codex`. Turn on only for the OpenAI Codex model_provider; leave off for standard API-key model_providers.
     #[tab(Connection)]
     #[serde(default, skip_serializing_if = "is_false")]
     #[credential_class = "external_auth_store"]

crates/zeroclaw-providers/src/openai_codex.rs

@@ -1219,7 +1219,7 @@ impl OpenAiCodexModelProvider {
                         "openai_codex: auth profile present but no usable access token"
                     );
                     anyhow::Error::msg(
-                        "OpenAI Codex credentials are present but expired or could not be refreshed. Re-run `zeroclaw auth login --provider openai-codex` to sign in again.",
+                        "OpenAI Codex credentials are present but expired or could not be refreshed. Re-run `zeroclaw auth login --model-provider openai-codex` to sign in again.",
                     )
                 } else {
                     ::zeroclaw_log::record!(
@@ -1233,7 +1233,7 @@ impl OpenAiCodexModelProvider {
                         "openai_codex: no auth profile found"
                     );
                     anyhow::Error::msg(
-                        "No OpenAI Codex credentials found. Run `zeroclaw auth login --provider openai-codex` to sign in.",
+                        "No OpenAI Codex credentials found. Run `zeroclaw auth login --model-provider openai-codex` to sign in.",
                     )
                 }
             })?)
@@ -1251,7 +1251,7 @@ impl OpenAiCodexModelProvider {
                     "openai_codex: account_id not found in profile/token"
                 );
                 anyhow::Error::msg(
-                    "OpenAI Codex account id not found in auth profile/token. Run `zeroclaw auth login --provider openai-codex` again.",
+                    "OpenAI Codex account id not found in auth profile/token. Run `zeroclaw auth login --model-provider openai-codex` again.",
                 )
             })?)
         };

crates/zeroclaw-runtime/locales/en/cli.ftl

@@ -549,6 +549,11 @@ cli-quickstart-peer-group-row = {$channel} → {$name} ({$count} peers)
 cli-quickstart-provider-local-label = {$name} (local)
 cli-quickstart-provider-type-prompt = Provider type
 cli-quickstart-alias-for = Alias for {$name}
+cli-quickstart-openai-auth-mode-label = Authentication
+cli-quickstart-openai-auth-mode-help = Choose `codex` to use a ChatGPT/Codex subscription auth profile. If you already signed in with the Codex CLI, run `zeroclaw auth login --model-provider openai-codex --import ~/.codex/auth.json`; otherwise run `zeroclaw auth login --model-provider openai-codex`.
+cli-quickstart-anthropic-auth-mode-label = Authentication
+cli-quickstart-anthropic-auth-mode-help = Choose `api_key` for an Anthropic Console key, or `setup_token` if you will run `claude setup-token` for Claude Max and paste the generated token.
+cli-quickstart-anthropic-api-key-help = Paste an Anthropic Console API key or the token generated by `claude setup-token`.
 cli-quickstart-model-field-missing-warning = WARN: schema produced no `model` field for `{$provider}` — falling back to manual entry. Please report this.
 cli-quickstart-model-id-for = Model id for {$name}
 cli-quickstart-risk-profile-prompt = Risk profile
@@ -594,6 +599,8 @@ cli-quickstart-error-not-type-alias-ref = `{$reference}` is not a `<type>.<alias
 cli-quickstart-error-no-configured-path = no `{$path}` configured
 cli-quickstart-error-provider-required = provider type, alias, and model are required
 cli-quickstart-error-unknown-provider-type = unknown model provider type `{$provider}` — pick one from the provider list
+cli-quickstart-error-unknown-openai-auth-mode = unknown OpenAI auth mode `{$mode}` — pick `api_key` or `codex`
+cli-quickstart-error-unknown-anthropic-auth-mode = unknown Anthropic auth mode `{$mode}` — pick `api_key` or `setup_token`
 cli-quickstart-error-alias-exists = alias `{$alias}` already exists
 cli-quickstart-error-no-profile = no `{$alias}` profile configured
 cli-quickstart-error-unknown-risk-preset = unknown risk preset `{$preset}`