# Credentials

> Prized does not store your dev credentials. setup hands your agents' sign-ins from your machine straight to the box over the SSH tunnel; the control plane never sees them, and they stay on the box.

URL: https://prized.dev/docs/credentials

## Hand them over from your machine [#hand-them-over-from-your-machine]

```bash
prized setup
# or, for the agents alone:
prized agents handoff claude codex
```

If you are signed in to a coding agent on your machine, the handoff moves that sign-in to the box over the SSH tunnel; the control plane never sees, stores, or proxies a credential. Consent is per concern: `prized setup` asks once for the agents it found, `prized agents handoff` asks per agent and lists the exact files; the GitHub token and git identity go along when gh is signed in here (`--no-gh` skips; `--non-interactive` runs and `prized agents handoff` need `--gh`); the Cursor installer (`--install-cursor`) needs its own yes.

| Tool        | What travels                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Claude Code | Your machine's sign-in (the macOS Keychain item or `~/.claude/.credentials.json`) is copied to `~/.claude/.credentials.json` on the box, 0600, with your MCP servers and settings; since the box refreshes it from then on, one side will eventually ask you to `/login` again. If your local sign-in is absent or cannot be read, no credentials, settings, or MCP configuration are copied and any existing box sign-in and configuration stay unchanged; the report says so, and says it too when the box is already signed in — nothing replaced that sign-in, so it stays in use, and on a box a teammate has worked on you should `/login` to make it yours. Sign in on the box with `claude`, then `/login`, or sign in locally and re-run the handoff to carry your settings too. |
| Codex       | `~/.codex/auth.json` and `config.toml` (which holds the MCP servers).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Cursor      | MCP and CLI config. Sign-in happens on the box: Cursor's credentials live in your system keychain, which Prized never reads, so `agent login` prints a URL to open.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| GitHub      | Your `gh` token, piped to `gh auth login --with-token` (never on a command line), plus your git name and email if the box has none.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Other CLIs  | With `--env-secrets` (or a yes to the secrets question): the project's `.env` files, CLI sign-in files (`~/.aws`, `~/.config/gcloud`, `~/.kube/config`, ...), and secret-looking env vars from your shell files, written 0600. See [Bring your environment](https://prized.dev/docs/environment). For AWS, a connected role needs none of this: see [AWS access](https://prized.dev/docs/aws).                                                                                                                                                                                                                                                                                                                                                                                                                                |

If the box's login profile sets `CLAUDE_CONFIG_DIR` to a directory other than `~/.claude`, a Claude sign-in handoff refuses before changing its credentials or configuration. Sign in with `claude` and `/login` on the box instead, or remove the redirect from its login profile before retrying the handoff.

A restricted box (safe for third parties, or from an [environment](https://prized.dev/docs/environments#safe-for-third-parties) with that switch on) never receives your credentials: the handoff and setup's agent, secrets and data steps refuse with `CHECK_FAILED` (exit 5). They also stop when the box's status cannot be checked: signed out is the usual `AUTH` (exit 8, run `prized login`); offline, or a box that is not in your workspace, is `CHECK_FAILED` (exit 5). Nothing is copied until it can be; `prized setup` still syncs the project and runs its other steps, and skips the credential ones with the reason on their rows.

MCP servers whose own sign-in cannot travel are reported as needing re-auth, with the command to run. The handoff is a one-shot copy; re-run it after changing MCP config.

### What the report means [#what-the-report-means]

| Result         | Meaning                                                                                   |
| -------------- | ----------------------------------------------------------------------------------------- |
| `ok`           | The tool answers that it is signed in; for GitHub, as the same account your machine uses. |
| `needs-reauth` | The material landed but the check disagreed, could not run, or found a different account. |
| `manual`       | Nothing to transfer; the printed steps sign you in on the box.                            |
| `needs-rerun`  | Skipped on purpose (the agent was running); re-run the handoff afterwards.                |

### Symlinks and order [#symlinks-and-order]

The handoff never writes a credential through a symlink, since on a box with a synced folder that could land it in your repo. A symlinked directory (`~/.codex`, `~/.cursor`, `~/.claude`, or a parent) stops the transfer and names the path; a symlinked file is replaced by a real file. Installs happen before any credential lands, and the GitHub token goes last.

On your machine, only real files travel: a config file that is itself a symlink (`~/.codex/auth.json` pointing elsewhere) is left out, and inside `~/.claude/agents` and `~/.claude/commands` a symlink is followed only while it stays inside that folder. What was left out is named in the consent prompt and the report. `CODEX_HOME` and `CLAUDE_CONFIG_DIR` are honored when they name a directory inside your home; anything else is ignored and said so.

## Or sign in on the box [#or-sign-in-on-the-box]

```bash
prized ssh
gh auth login
claude
```

One command per tool, in a shell on the box; disks persist, so it is once per box. This is what the handoff falls back to when there is nothing to transfer.

### Copying the sign-in link [#copying-the-sign-in-link]

Claude prints a sign-in link on the box. Select it and press **c**: through `prized ssh` it lands on your clipboard, Apple Terminal included ([Copy out](https://prized.dev/docs/sessions#copy-out)). Paste it in a browser, then paste the code back into Claude. To select with the mouse instead, hold **Fn** (Apple Terminal), **Option** (iTerm2) or **Shift** while dragging, then Cmd-C.

## Secrets for agents [#secrets-for-agents]

For API keys an agent should use but never read, the dashboard has **Secrets**. Paste a value once; it is encrypted at rest and cannot be read back. Processes on the box see a placeholder, and when one calls an HTTPS host you allowlisted, the box's broker swaps the real value into the request headers on the way out; plain HTTP is refused.

A secret with no grants is available to every box in the workspace except a contractor's; grant it to boxes or members and only those boxes can mount it. Each secret also shows which boxes spent it against which hosts, how often, and when (never a value). Both are on [Teams: Scoped secrets](https://prized.dev/docs/teams#scoped-secrets). Provider presets are [Connectors](https://prized.dev/docs/connectors).

## The machine itself [#the-machine-itself]

Every box is its own machine, reached only through your encrypted tunnel; how that tunnel works, what the box exposes, and what the control plane can and cannot see are in [Security and trust](https://prized.dev/docs/security).

## What Prized itself stores [#what-prized-itself-stores]

`prized login` writes a CLI token and an SSH identity to `~/.config/prized` on your machine; the token authenticates you to the control plane. Login also registers the identity's public key with your workspace, so your boxes accept it as a restricted, tunnel-only fallback for SSH clients that cannot use certificates ([Claude Desktop remote](https://prized.dev/docs/claude-desktop)). The private key never leaves your machine, and your dev credentials never leave your machines. **Dashboard → Workspace → CLI tokens** retires a machine's token, which signs it out and drops its key from your boxes ([Workspaces: CLI tokens](https://prized.dev/docs/workspaces#cli-tokens)).

While signed in, the CLI reports which commands ran (name, version, OS, duration, exit code), never arguments, paths, or file contents. Opt out under [CLI: usage telemetry](https://prized.dev/docs/cli#usage-telemetry).