Credentials.

Hand them over from your machine

prized setup
# or, for the agents alone:
prized agents handoff claude codex

If you are signed in to a coding agent on your machine, the handoff moves that sign-in to the box over the SSH tunnel; the control plane never sees, stores, or proxies a credential. Consent is per concern: prized setup asks once for the agents it found, prized agents handoff asks per agent and lists the exact files; the GitHub token and git identity go along when gh is signed in here (--no-gh skips; --non-interactive runs and prized agents handoff need --gh); the Cursor installer (--install-cursor) needs its own yes.

A restricted box (safe for third parties, or from an environment with that switch on) never receives your credentials: the handoff and setup's agent, secrets and data steps refuse with CHECK_FAILED (exit 5). They also stop when the box's status cannot be checked: signed out is the usual AUTH (exit 8, run prized login); offline, or a box that is not in your workspace, is CHECK_FAILED (exit 5). Nothing is copied until it can be; prized setup still syncs the project and runs its other steps, and skips the credential ones with the reason on their rows.

MCP servers whose own sign-in cannot travel are reported as needing re-auth, with the command to run. The handoff is a one-shot copy; re-run it after changing MCP config.

What the report means

Symlinks and order

The handoff never writes a credential through a symlink, since on a box with a synced folder that could land it in your repo. A symlinked directory (~/.codex, ~/.cursor, ~/.claude, or a parent) stops the transfer and names the path; a symlinked file is replaced by a real file. Installs happen before any credential lands, and the GitHub token goes last.

On your machine, only real files travel: a config file that is itself a symlink (~/.codex/auth.json pointing elsewhere) is left out, and inside ~/.claude/agents and ~/.claude/commands a symlink is followed only while it stays inside that folder. What was left out is named in the consent prompt and the report. CODEX_HOME and CLAUDE_CONFIG_DIR are honored when they name a directory inside your home; anything else is ignored and said so.

Or sign in on the box

prized ssh
gh auth login
claude

One command per tool, in a shell on the box; disks persist, so it is once per box. This is what the handoff falls back to when there is nothing to transfer.

Secrets for agents

For API keys an agent should use but never read, the dashboard has Secrets. Paste a value once; it is encrypted at rest and cannot be read back. Processes on the box see a placeholder, and when one calls an HTTPS host you allowlisted, the box's broker swaps the real value into the request headers on the way out; plain HTTP is refused.

A secret with no grants is available to every box in the workspace except a contractor's; grant it to boxes or members and only those boxes can mount it. Each secret also shows which boxes spent it against which hosts, how often, and when (never a value). Both are on Teams: Scoped secrets. Provider presets are Connectors.

The machine itself

Every box is its own machine, reached only through your encrypted tunnel; how that tunnel works, what the box exposes, and what the control plane can and cannot see are in Security and trust.

What Prized itself stores

prized login writes a CLI token and an SSH identity to ~/.config/prized on your machine; the token authenticates you to the control plane. Login also registers the identity's public key with your workspace, so your boxes accept it as a restricted, tunnel-only fallback for SSH clients that cannot use certificates (Claude Desktop remote). The private key never leaves your machine, and your dev credentials never leave your machines. Dashboard → Workspace → CLI tokens retires a machine's token, which signs it out and drops its key from your boxes (Workspaces: CLI tokens).

While signed in, the CLI reports which commands ran (name, version, OS, duration, exit code), never arguments, paths, or file contents. Opt out under CLI: usage telemetry.