# Credentials > How your agents' and tools' sign-ins reach a box: handed over from your machine through the SSH tunnel, never seen, stored, or proxied by the control plane. URL: https://prized.dev/docs/credentials ## Hand them over from your machine [#hand-them-over-from-your-machine] ```bash prized setup # or, for the agents alone: prized agents handoff claude codex ``` Each asks first: `prized setup` once for the agents it found, `prized agents handoff` per agent with the exact files listed, and the Cursor installer (`--install-cursor`) separately. The GitHub token and git identity go along when `gh` is signed in on your machine (`--no-gh` skips them; `--non-interactive` runs and `prized agents handoff` need `--gh`). | Tool | What travels | | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Claude Code | Your sign-in (the macOS Keychain item or `~/.claude/.credentials.json`), with your MCP servers and settings, to `~/.claude/.credentials.json` on the box (0600). The box refreshes it from then on, so one side will eventually ask you to `/login` again. With no readable local sign-in, nothing is copied and the box keeps its own, as the report says (on a box a teammate used, `/login` to make it yours); sign in on the box with `claude`, then `/login`, or locally and re-run the handoff to carry your settings too. | | Codex | `config.toml` (with your MCP servers) and an API-key sign-in in `~/.codex/auth.json`. A ChatGPT sign-in stays put, since its single-use refresh token would sign one side out: the handoff runs `codex login` on the box and opens its sign-in page in your browser; when the browser says the sign-in was delivered, return to your terminal for the result. With `--json` or `--non-interactive`, the report prints the steps instead: `prized ssh`, then `codex login --device-auth` on the box. | | Cursor | MCP and CLI config. Cursor's sign-in lives in your system keychain, which Prized never reads; on the box, `agent login` prints a URL to open. | | GitHub | Your `gh` token, piped to `gh auth login --with-token` (never on a command line), plus your git name and email if the box has none. | | Other CLIs | With `--env-secrets` (or a yes to the secrets question): the project's `.env` files, CLI sign-in files (`~/.aws`, `~/.config/gcloud`, `~/.kube/config`, ...), and secret-looking env vars from your shell files, written 0600 ([Bring your environment](https://prized.dev/docs/environment)). For AWS, a [connected role](https://prized.dev/docs/aws) needs none of this. | A box [safe for third parties](https://prized.dev/docs/environments#safe-for-third-parties), itself or through its environment, never receives your credentials: the handoff and setup's agent, secrets and data steps refuse it with `CHECK_FAILED` (exit 5). They also copy nothing while the box's status cannot be checked: signed out is `AUTH` (exit 8, run `prized login`); offline, or a box outside your workspace, is `CHECK_FAILED` (exit 5). `prized setup` still syncs the project and runs its other steps. MCP servers whose sign-in cannot travel are reported as needing re-auth, with the command to run. The handoff is a one-time copy: re-run it after changing MCP config. ### What the report means [#what-the-report-means] | Result | Meaning | | -------------- | --------------------------------------------------------------------------------------- | | `ok` | The tool says it is signed in (for GitHub, as the same account as your machine). | | `needs-reauth` | The files landed, but the check disagreed, could not run, or found a different account. | | `manual` | Nothing to transfer; the printed steps sign you in on the box. | | `needs-rerun` | Skipped on purpose (the agent was running); re-run the handoff afterwards. | ### Symlinks and order [#symlinks-and-order] The handoff never writes a credential through a symlink, which on a box with a synced folder could land it in your repo: a symlinked directory (`~/.codex`, `~/.cursor`, `~/.claude`, or a parent) stops the transfer and names the path, and a symlinked file is replaced by a real file. Installs run first; the GitHub token goes last. From your machine, only real files travel: a symlinked config file (`~/.codex/auth.json` pointing elsewhere) is left out, and the consent prompt and the report say so. ## Or sign in on the box [#or-sign-in-on-the-box] ```bash prized ssh gh auth login claude codex login --device-auth ``` Once per box is enough; disks persist. `codex login --device-auth` prints a code to enter in a browser on any device; if your account has no device-code sign-in, run `prized agents handoff codex` on your machine to sign the box in through your browser. ### Copying the sign-in link [#copying-the-sign-in-link] Claude prints a sign-in link: select it and press **c** to copy it to your clipboard through `prized ssh` ([Copy out](https://prized.dev/docs/sessions#copy-out)). Paste it in a browser, then paste the code back into Claude. ## Secrets for agents [#secrets-for-agents] For API keys an agent should use but never read, use **Secrets** in the dashboard: a value is encrypted at rest, cannot be read back, and shows up on the box only as a placeholder. The box's broker swaps in the real value on requests to HTTPS hosts you allowlisted; plain HTTP is refused. A secret is open to every box but a contractor's until you grant it to boxes or members; scoping and each secret's usage record (never a value) are on [Teams: Scoped secrets](https://prized.dev/docs/teams#scoped-secrets). Provider presets are [Connectors](https://prized.dev/docs/connectors). ## Keys for other agents and backends [#keys-for-other-agents-and-backends] OpenCode and pi have no handoff, and a model written `amazon-bedrock/…`, `openrouter/…` or `deepseek/…` runs any agent on that backend ([Models and backends](https://prized.dev/docs/remote-agents#models-and-backends)). Both read keys from the box's environment: add each key as a Secret under the name below, with its allowed host, and plain values such as `AWS_REGION` as an [environment](https://prized.dev/docs/environments) or per-box env var. | Backend | Set on the box | Allowed host for the Secret | | -------------- | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | Amazon Bedrock | `AWS_REGION`, plus `AWS_BEARER_TOKEN_BEDROCK` (a Bedrock API key), or `AWS_PROFILE` naming a [connected AWS role](https://prized.dev/docs/aws) | `bedrock-runtime..amazonaws.com`, and `bedrock-mantle..api.aws` for Codex | | OpenRouter | `OPENROUTER_API_KEY` | `openrouter.ai` | | DeepSeek | `DEEPSEEK_API_KEY` | `api.deepseek.com` | What each agent gets on a backend, set for that run only (its config files are never edited): | Agent | Amazon Bedrock | OpenRouter | DeepSeek | | ------------ | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | | Claude Code | `CLAUDE_CODE_USE_BEDROCK=1`; region from `AWS_REGION` or the profile | `ANTHROPIC_BASE_URL=https://openrouter.ai/api`, `ANTHROPIC_AUTH_TOKEN` set to the key | `ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic`, `ANTHROPIC_AUTH_TOKEN` set to the key | | Codex | Its built-in `amazon-bedrock` provider, in a region Bedrock serves OpenAI models from | A provider for `https://openrouter.ai/api/v1` reading `OPENROUTER_API_KEY` | A provider for `https://api.deepseek.com/` reading `DEEPSEEK_API_KEY`, web search off | | OpenCode, pi | Read the same variables themselves | Read `OPENROUTER_API_KEY` | Read `DEEPSEEK_API_KEY` | On OpenRouter and DeepSeek, Claude Code also gets `ANTHROPIC_API_KEY` and `CLAUDE_CODE_OAUTH_TOKEN` blanked, over your settings files too, so your Claude sign-in is never sent to another provider. The run refuses to start without the backend key, or when a Claude Code settings file (yours, wherever `CLAUDE_CONFIG_DIR` puts it, or the project's) sets its own `ANTHROPIC_AUTH_TOKEN` or `apiKeyHelper`. > AWS access keys sign requests instead of travelling in them, so a Secret placeholder cannot stand in for them: use a Bedrock API key, a connected role, or a `~/.aws/credentials` secret file. Without a backend, OpenCode and pi use the provider their model names, with that provider's usual key: `ANTHROPIC_API_KEY` and `OPENAI_API_KEY` (the Anthropic and OpenAI [Connectors](https://prized.dev/docs/connectors) set them), `GEMINI_API_KEY`, `MISTRAL_API_KEY` and the rest. Or sign in on the box once: `opencode auth login`, or `pi` then `/login`. ## The machine itself [#the-machine-itself] Every box is its own machine, reached only through your encrypted tunnel; what it exposes and what the control plane can see are on [Security and trust](https://prized.dev/docs/security). ## What Prized itself stores [#what-prized-itself-stores] `prized login` writes an API key and an SSH identity to `~/.config/prized` on your machine, and registers the identity's public key with your workspace as a restricted, tunnel-only fallback for SSH clients that cannot use certificates ([Claude Desktop remote](https://prized.dev/docs/claude-desktop)). The private key never leaves your machine, and your dev credentials never leave your machines. Revoking a machine's API key signs it out and drops its SSH key from your boxes ([Workspaces: API keys](https://prized.dev/docs/workspaces#api-keys)). While signed in, the CLI reports which commands ran (name, version, OS, duration, exit code), never arguments, paths, or file contents; opt out under [CLI: usage telemetry](https://prized.dev/docs/cli#usage-telemetry).