Organization Edition

What it is

Personal Hara connects directly to a provider or local model. Organization Edition adds another route: a company operates Hara Control, keeps the upstream model credentials on the server, and gives each member a scoped, revocable device credential.

The employee does not need a personal provider key. The administrator chooses the model and can set device-key expiry, independent 5-hour / 7-day / 30-day spend limits, RPM, and TPM. Members can still keep personal and company connections side by side.

What you receive from your administrator

You need exactly two onboarding values:

the company's public HTTPS Hara Control origin, for example https://gw.example.com;
a short-lived, single-use enrollment code.

The gateway origin is for devices. It is deliberately different from the private admin console URL. Do not ask for or paste an admin password, upstream API key, or another member's device token.

Join from Hara Desktop

Open Settings → AI & models.
Under Enterprise managed, choose +.
Enter a recognizable connection name, the HTTPS Control origin, and the one-time code.
Choose Add and switch, or save it without changing the current project route.

Enterprise connections belong to the user; none is prefilled by Hara. You can add several Hara Control deployments, inspect each connection's model and expiry, check connectivity, re-enroll an expiring connection, and switch the route used by new sessions. A launch flag, environment override, or project profile pin can intentionally prevent Desktop from changing the active route.

Add the organization's Desk

The model gateway and the collaboration Desk are deliberately separate bindings. After the Hara Control profile exists, register that organization's Desk explicitly:

hara desk register \
  --profile acme-work \
  --url https://desk.example.com \
  --key <desk-enrollment-key>

Desktop 0.1.45 can then show that organization in the optional Groups module. Choosing an organization there is a browsing action; Use for new work remains the explicit routing action. Board and task reads are user-triggered, bounded, profile-pinned, and read-only. The managed web/admin surface remains the place for task writes, enrollment-key administration, token rotation, audit recovery, and owner operations.

Join from the CLI

Use a named profile so the organization remains distinct from personal model settings:

hara profile add acme-work \
  --gateway https://gw.example.com \
  --code <one-time-code>
 
hara profile use acme-work
hara profile list

The code is exchanged once and discarded. The scoped credential is kept in Hara's protected local profile store; it is never displayed back by the ordinary settings UI.

Use both DeepSeek V4 Flash and Pro

Hara Control scopes model access to the device credential. Starting with Control 0.1.15, one enrollment authorizes the complete model catalog allowed by the deployment, so keep one company connection and select Flash or Pro for each new run:

hara profile use acme-work
hara --profile acme-work --model deepseek-v4-flash -p "Summarize this file"
hara --profile acme-work --model deepseek-v4-pro   -p "Review the design"

Desktop uses the same connection catalog. After enrollment or the next heartbeat/check, its model picker shows both authorized models; existing 0.1.14-era single-model credentials are expanded in place, without changing the raw Token. The picker still cannot add a model outside the server catalog. Both models offer off, high, and max thinking controls.

Keep and switch several routes

hara profile use personal             # change the global default
hara profile use acme-work            # change it back
hara --profile acme-work -p "…"       # one run only
hara profile pin acme-work             # keep this project on the company route

New sessions use the current route, and a session's selected model and thinking control remain constrained by the active enterprise credential. Confirm the active profile before resuming an older session after a connection switch. Use a local profile pin when company work must never fall back to a personal bill.

Expiry, re-enrollment, and removal

Hara surfaces an upcoming managed-access expiry and refuses to use an expired device credential. Ask your administrator for a new one-time code, then use Desktop's Re-enroll action or run the same hara profile add <id> --gateway … --code … command again with the existing profile id.

Removing an enterprise connection from one computer deletes only that local profile. It does not revoke the server-side credential; administrators should revoke lost, reassigned, or retired devices from the Fleet page.

What administrators see

Administrators do not need to collect raw device tokens. Hara Control provides organization-scoped enrollment, fleet and revocation, plus 24-hour / 7-day / 30-day usage views with billed spend, token and request totals, timelines, model/device breakdowns, and rolling quota progress. See Hara Control: Self-hosting & Fleet for the administrator and deployment guide.

New to Hara? Start with Installation. Hara Desktop includes its own verified engine, while the standalone CLI requires Node.js 22.12 or newer.