Getting Your Cornell AI Gateway Key

Every way of using Claude at Cornell needs a personal key. You create it yourself in the JCB AI key portal.

🔌 You'll need a wired connection or the VPN

The key portal is only reachable from a wired Cornell connection or the Cornell VPN.

This applies to the key portal only — Claude itself works from anywhere once it's set up.

Step 1 — Create your key

1. Go to https://keys.ai.business.cornell.edu/ and sign in.
2. Click Create key and fill in the form:

3. Note the expiration date shown on the form. Keys currently expire at the end of the calendar quarter, not a fixed number of days after you create one — so a key made in early July runs until September 30. Keys created in the last couple of weeks of a quarter are the exception: they run to the end of the following quarter instead, so a key made on September 25 lasts until December 31 rather than expiring the same week. The date on your own key is the one that applies — see Managing, Rotating, and Renewing Your Key for renewing it.
4. Click Create key.

ℹ️ A ticket is opened for you. Requesting a key for Claude Desktop use also generates a TDX ticket automatically, and someone from Client Services will reach out to coordinate any follow-up your machine needs. You don't have to submit a separate request alongside the form.

Step 2 — Generate the secret

Creating the key does not give you the secret. The portal deliberately keeps those separate.

1. Find your new key in the list and click its row to expand it.
2. Click Generate Key.
3. Copy the secret somewhere safe — you will paste it during installation.

This panel is also where you manage the key later — adjusting the spend cap, adding delegates, checking spend history, or disabling it. See Managing, Rotating, and Renewing Your Key.

⚠️ Generate the secret yourself, right before you need it. If someone set the key up for you, you should be the one to generate the secret. Treat it like a password: don't email it, don't post it in Teams, don't paste it into a shared document.

About the spend cap

The cap is a monthly ceiling on what this key can spend, in real dollars — Cornell bills gateway usage at Anthropic's published rates, with no markup. AI at Cornell lists the exact per-model rates on its Available Models & Pricing page (NetID sign-in).

There is no standard figure; appropriate values vary enormously depending on how you work. Pick something that reflects your expected use, and raise, lower, or reset it at any time from the key portal, with no ticket and no downtime.

It does two jobs. The first is keeping usage visible and attributable to a KFS account — that part is not about rationing you.

The second is a backstop. Gateway usage is billed as it happens and cannot be refunded, so the cap is the only thing standing between an unexpected bill and your account. Three situations make that matter:

• A long-running or unexpectedly expensive job — a large set of documents, or a task that turns out to need far more work than it looked like.
• A stolen secret — if one leaks, the cap bounds what someone else can spend before you rotate it.
• Ordinary misuse — a key shared, pasted somewhere it shouldn't be, or pointed at something it wasn't meant for.

Set it high enough not to interrupt real work, low enough that a runaway month is survivable.

If you hit the cap, Claude stops responding — and it doesn't say so. The error blames the server for "temporarily limiting requests" and offers a Try again button; the real reason only appears under View details. Worth knowing that symptom before you meet it — Managing, Rotating, and Renewing Your Key shows both screens.

Where your key goes

One key works everywhere. A single key covers Claude Desktop, Claude Code, and anything else on the gateway — you never need a second one.

You may still want one. Each key carries its own spend cap, KFS account, and spend history, so a second key is the simplest way to keep two things apart:

• Separate budgets — a grant-funded project and your general teaching work, each with its own ceiling and its own actual spend tracked separately.
• Separate billing — usage that has to be attributed to a different KFS account.
• Separate blast radius — a key used somewhere riskier (a shared machine, an automation) can be disabled without disturbing your day-to-day one.

If none of that applies, one key is the right answer.

Next step

Install Claude Desktop — Installing Claude Desktop on macOS (Pilot) or Installing Claude Desktop on Windows (Pilot).

Questions? Email itrequests@business.cornell.edu.