Credentials.

Hand them over from your Mac

prized setup
# or, for the agents alone:
prized agents handoff claude codex

If you are already signed in to a coding agent on your Mac, the handoff moves that sign-in to the box so you never retype an OAuth flow. The transfer runs from your Mac to the box directly over the existing SSH tunnel: the control plane never sees, stores, or proxies a credential, the same trust surface as signing in on the box yourself. Consent is per concern, never blanket: it asks per agent, listing the exact files and remote commands, and the GitHub token (--gh) and the Cursor installer (--install-cursor) each need their own yes. Config files travel as-is, and some can embed API keys (an agent's settings file, MCP server definitions); the prompt flags those before anything is copied.

Per tool:

• Claude Code. Its sign-in does not survive a file copy, so the handoff runs claude setup-token on your Mac (a browser sign-in that mints a long-lived token; needs a Pro, Max, or Team plan) and places the token on the box. Your MCP servers and settings are carried over alongside it. If that command cannot open a browser, it prints a URL to visit; the URL is shown to you, the token it prints is not.
• Codex. ~/.codex/auth.json and config.toml (which holds the MCP servers) are copied; this is Codex's own documented path for headless machines.
• Cursor. MCP and CLI config are copied. Sign-in is guided on the box: Cursor's macOS credentials live in the Keychain, which Prized never reads, so agent login prints a URL you open on your Mac.
• GitHub. With --gh, your gh token is piped to gh auth login --with-token on the box, never through a command line, and your git name and email are copied if the box has none.

MCP servers whose own sign-in cannot travel are reported per server as needing re-auth, with the in-tool command to run; nothing fails silently. A server whose auth Prized cannot account for either way is reported unknown rather than ok: the file it would have travelled in exists on the box, but nothing in it names that server. Servers configured for one project rather than globally get their own rows, marked [project]. The handoff is a one-shot copy: re-run it after changing MCP config on the Mac.

The report says what was actually checked, and only that:

Two consequences worth knowing. A box already signed in to GitHub as another account never reads as success, because the accounts are compared, not just the presence of a login. And Claude Code has no scriptable status command, so a token sitting on the box is reported as exactly that, never as a verified live sign-in.

The handoff never writes a credential through a symlink. A link would put a fresh sign-in wherever it points, which on a box with a synced project folder can mean the credential lands in your repo. So if ~/.codex, ~/.cursor, ~/.claude, ~/.claude.json — or a directory above one of them — is a symlink on the box, one of two things happens. A symlinked directory stops the transfer, which names the path; replace it with a real directory (or move the target out of the synced tree) and re-run. A symlinked file is replaced by the real file, so the credential lands where it belongs and the link is gone. Either way nothing is written to what the link pointed at. If you manage the box's home with dotfiles, this is the case to know about.

The order inside one run is fixed: anything that installs software on the box (the Cursor installer) runs before any credential lands there, and the GitHub token goes last. That holds even when a --clone project needs GitHub auth to clone, which pulls the token step earlier: the installer moves ahead of it rather than running on a box that already holds your token.

Or sign in on the box

prized ssh
gh auth login
claude

The manual path still works, and it is what the handoff falls back to when there is nothing to transfer: one command per tool, run in a shell on the box, gh auth login for GitHub, claude for Claude Code, codex for Codex. Each stores its credential on the box the way it would on any machine. Since disks persist, either way you do this once per box.

Secrets for agents

For API keys that agents should use but never read, the dashboard has Secrets. You paste a value once; it is encrypted at rest and cannot be read back from the dashboard. Processes on the box see only a placeholder. When one calls an HTTPS host you allowlisted for that secret, the box swaps the real value into the request headers on the way out. Plain HTTP to an allowlisted host is refused, so a brokered value is never injected into cleartext transport.

So the key never appears in env files, shell history, or logs, and a leaked placeholder is worthless. The real value lives in the memory of the box's broker process, not on its disk. For common provider presets, see Connectors.

The machine itself

Every box is a dedicated machine; no other customer can log in to it or read its disk. Traffic between your Mac and the box runs over an encrypted tunnel, and nothing on the box is reachable from the internet except that tunnel's endpoint. SSH and your dev ports are never exposed publicly.

What Prized itself stores

Signing in with prized login writes a CLI token and an SSH identity to ~/.config/prized on your Mac. The token authenticates you to the control plane, where boxes are created and managed. Your dev credentials never leave your machines: the handoff moves them from the Mac to the box, and the control plane is not on that path.

While you are signed in, the CLI also reports which commands ran (name, version, OS, duration, exit code) so we can find and fix problems. It never reports arguments, paths, or file contents. See CLI: usage telemetry for the opt-out.