AI vendor integrations
Pull spend and usage straight from the AI vendors you already pay for.
AI vendor integrations connect the AI vendors your organization already pays for, so Proxon reports actual spend and usage straight from the vendor rather than only what the client-side observers can see. The numbers come from the vendor's own admin and billing data, which makes them the most accurate cost source. They also include usage that never touches an employee's machine, such as server-side or automated calls.
An admin connects each vendor once, from the Integrations page in Proxon. Nothing installs on anyone's device. Most vendors need a read-only credential that you create in the vendor's own admin console first, so you need admin access to the vendor you are connecting. Open Integrations, find the vendor under AI, and follow its Connect dialog. What each vendor needs is below.
Proxon stores these credentials encrypted at rest and in transit, and uses them only to read usage and spend. It never uses them to train models and never shares them with third parties.
Claude API
Create a Claude API Admin API key with organization-level access from the Claude Console, under Organization settings → Admin keys. An org owner or admin creates it. Paste the key, which starts with sk-ant-admin-, into the Connect dialog.
Claude Enterprise
Create a Claude Enterprise API key at claude.ai, under Organization settings → API. Your organization's primary owner creates it, and it needs the read:analytics and read:members scopes. Analytics API access has to be enabled for your organization first. Paste the key, which starts with sk-ant-api01-, into the Connect dialog.
Proxon adds the members of your Claude Enterprise organization to your org chart automatically. An org chart import from your HRIS should still be done, because it will likely include more people than just your Claude users and it fills in names, job titles and departments.
The Connect dialog has two optional sections, Pricing and prepaid credits and OTel monitoring. Both are collapsed or ready to open when the dialog appears, and you can come back to either one later.
Add your plan and pricing
Open Pricing and prepaid credits so Proxon can report your Claude Enterprise spend accurately.
- Seat rate: Enter the amount you pay, whether it is per seat or per account, whether it is billed per month or per year, and how many seats you have.
- Prepaid credits: If your invoice includes a prepaid usage-credit pack, enter its amount and its term start and end dates. Proxon shows how much of the pack has been used.
Only people who can edit pricing see this section.
Send Claude Code, Cowork, and Office agent usage with OTel
Open OTel monitoring to add visibility into Claude Code, Cowork, and the Office agents. Nothing installs on anyone's device. Only organization owners and admins see this section.
- Choose Generate Key. Proxon shows the key once, so copy it now. The key is already filled into the values below.
- Paste the values for each product into the Anthropic admin console. Each product has its own tab in the dialog, and none of the three reads the others, so set all three.
| Product | Where to paste it |
|---|---|
| Claude Code | Admin settings → Claude Code → Managed settings. Add the keys to the env object of your existing settings. |
| Cowork | Admin settings → Cowork → Monitoring |
| Office agents | Admin settings → Office agents → Monitoring |
The endpoint is https://ingest.proxon.ai and the protocol is http/protobuf. People see a one-time prompt to approve that endpoint the first time they start Claude Code. A session that was already running sends nothing until it restarts.
Cloud sessions on claude.ai/code also need ingest.proxon.ai added to the cloud environment's Custom allowed domains list. Managed settings cannot add a domain.
If you close the dialog and come back, Proxon masks the key in the values and does not show it again. To get a key you can paste again, rotate the credential in Org Settings → Credentials.
This covers Claude Code, Cowork, and the Office agents. Chat on claude.ai, Claude Desktop, Claude in Chrome, and Claude in Slack come through the Analytics API connection above.
Map people
Proxon matches each Claude Enterprise member to a person in your organization automatically. It tries the address they sign in to Claude with first, then an exact display-name match against your people when that name is unique. Matching never creates a person.
Some members cannot be matched this way. The usual cause is a Claude sign-in that differs from the work email Proxon knows, such as an alias or a plus-addressed variant. When that happens, the Claude Enterprise panel on the Integrations page shows "N people need mapping" with a Map people action. The dialog lists every member with their Claude sign-in, their display name, and the person they resolved to, or "Needs mapping" for anyone still unmatched. Pick the matching person for each one, or unmap a person Proxon matched incorrectly. Anyone left unmapped stays unmapped until an admin maps them. Saving starts a resync, so My Usage and Cost Intelligence update without waiting for the next scheduled pull.
The same admins who can connect the integration can map people.
OpenAI API
Create an OpenAI Admin API key in the OpenAI platform, under Organization settings → Admin keys, with its Permissions set to Read. Paste the key, which starts with sk-admin-, into the Connect dialog.
Microsoft 365 Copilot
Register an app in Microsoft Entra ID as a Global Administrator, under Entra ID → App registrations. Grant it these application permissions with admin consent: Organization.Read.All, User.Read.All, Reports.Read.All, and ReportSettings.Read.All. Then paste the app's Directory (tenant) ID, Application (client) ID, and a client secret into the Connect dialog. Copy the secret Value, not the Secret ID.
Map people
Proxon matches each licensed Copilot user to a person in your organization automatically. It tries the user's Microsoft mail first, then the proxyAddresses and otherMails aliases, then an exact display-name match against your people when that name is unique. The User.Read.All grant above already covers these fields, so no new Entra consent is needed.
Some users cannot be matched this way. The usual cause is a tenant whose sign-in names are @<tenant>.onmicrosoft.com rather than the work email Proxon knows. When that happens, the Microsoft 365 Copilot panel on the Integrations page shows "N people need mapping" with a Map people action. The dialog lists every licensed Copilot user with their Microsoft sign-in name, their display name, and the person they resolved to, or "Needs mapping" for anyone still unmatched. Pick the matching person for each one, or unmap a person Proxon matched incorrectly. Saving starts a resync, so charts update without waiting for the next scheduled pull.
The same admins who can connect the integration can map people.
GitHub Copilot
Connect GitHub Copilot through its sign-in flow. Choose it on the Integrations page, authorize Proxon when GitHub asks, and you are done. There is no key to create.
Gemini for Workspace
Create a Google Cloud service account with a JSON key, then grant it domain-wide delegation for two read-only scopes: admin.reports.audit.readonly and admin.directory.user.readonly. Both are required. We recommend also adding the apps.licensing scope and turning on the Enterprise License Manager API in the service account's Google Cloud project. With both, Proxon can also see who holds a Gemini license, so it reports seats and not just usage. Without them, usage still flows in but no seats are counted. Grant the delegation as a Super Admin, under Admin console → Security → API controls → Domain-wide delegation. In the Connect dialog, paste the JSON key file you downloaded. The dialog fills in the service account email and the private key from it. Then enter a delegated admin email. If you would rather type the service account email and the private key yourself, choose Enter manually. The delegated admin is a Super Admin in your Google Workspace for the service account to impersonate, not the service account itself. Leave Customer ID blank unless you are a reseller connecting a downstream tenant.