ISMS Copilot Docs

Set up the model API from Claude Code or Grok

After one human pat-isms login, agents can mint sk-isms keys and open a credit checkout when server flags are on.

This is the agent-native path for the OpenAI-compatible model API (sk-isms-… + prepaid credits). It is separate from chat Account MCP conversations (pat-isms-… usage under your chat plan).

Honest status (2026-07-30): the Account MCP tools for keys and checkout are shipped in code behind server flags (ACCOUNT_MCP_API_KEYS_ENABLED, ACCOUNT_MCP_API_CHECKOUT_ENABLED) that default off. Until a founder turns them on for your environment, agents will not see those tools and you should use the console path. Human creation of pat-isms and payment in a browser are always required.

Planes (do not mix)

PlaneCredentialBilling
Model APIsk-isms-…Prepaid API credits
Account MCPpat-isms-…Chat subscription

pat-isms never authenticates api.ismscopilot.com inference. sk-isms never authenticates Account MCP.

Happy path (when MCP key tools are enabled)

  1. Human: Sign in to chat → Settings → Connected apps.
  2. Human: Create a pat-isms-… token with Model API scopes:
    • api_keys:read / api_keys:write
    • api_credits:read / api_credits:checkout (checkout only when that flag is on)
  3. Human: Register MCP, for example:
claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcp \
  --header "Authorization: Bearer pat-isms-…"
  1. Agent (MCP tools):
    • create_api_key → store sk-isms-… once
    • get_api_credit_balance → if zero, create_api_credit_checkout with amount ≥ 20
  2. Human: Open the Stripe Checkout URL and pay (min $20). Success returns to platform.ismscopilot.com/credits.
  3. Agent: Poll get_api_credit_balance until > 0, then call:
curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-…" \
  -H "Content-Type: application/json" \
  -d '{"model":"isms-fast","messages":[{"role":"user","content":"List 3 ISO 27001 access control themes."}]}'

Prefer omit max_tokens on thinking aliases, or use at least 1024 (see Models and regions).

Limits and safety

RuleDetail
Active keysMax 20 active sk-isms keys per user (console and MCP share the cap)
CheckoutMin $20; MCP path rate-limited (5 sessions / hour / user)
PaymentAlways a human browser; agents never charge a card
Revokerevoke_api_key (when tools enabled) or platform console

Always available (console)

If MCP tools are off or you prefer the browser:

  1. platform.ismscopilot.com/keys → create sk-isms
  2. platform.ismscopilot.com/credits → top up
  3. Follow Get an API key and first completion

On this page

Planes (do not mix)Happy path (when MCP key tools are enabled)Limits and safetyAlways available (console)Related