Credentials
Connections
Link the accounts and keys your agents sign in with, choose who can use each, and disconnect one.
Updated
On this page
A connection is an account or key your agents sign in with: your model provider's subscription or API key, a GitHub installation, a password. You link it once in the Console, and agents use it by name. Open Connections in the workspace.
Link one#
- Press Add a connection and pick the provider.
- Under How it signs in, choose the Method when the provider has several, such as a subscription token or an API key. Follow the steps the page shows for it.
- Give it a Name. Launches and hires refer to it by this name.
- Paste the value. For GitHub there's nothing to paste: you continue on GitHub, install the app there, and come back to the new connection's page.
- Under Who can use this?, choose its Scope:
| Scope | Who can read it |
|---|---|
| Only me | You and your agents |
| This workspace | Every agent in this workspace |
| The whole organization | Every agent in every workspace of the organization |
If two connections have the same name, yours wins over the workspace's, and the workspace's over the organization's. A subscription token has no choice of scope: it's one person's account, so it links to you alone.
You can also add a model connection while you hire, from the harness picker's Connection (Hire an agent).
What an agent can reach#
An agent can reach every connection its person can, not only the one it thinks with. So can the machine it runs on, and an App's code running with it. Link at the narrowest scope that works, and hire onto Apps and Computes you trust.
A connection's page says how agents use it, under How agents use it: either in the environment at launch, under the name it shows, or fetched when a program asks. Used by lists what uses it.
Disconnect one#
On the connection's page, under Danger zone, press Disconnect… and confirm. Every Instance in reach is refused it on its next fetch, unless a connection with the same name at another scope takes its place. A value already in a running container's environment stays until that container is re-created. This can't be undone, and the name is free for a new one.
For GitHub, disconnecting removes the saved credential from Uremot. It doesn't uninstall the app from GitHub: do that on GitHub too.
Next#
- Variables and credentials in a desk: plain values, secrets, and how a program reads them.
- For your AI: the
uremot-connectionsskill uses credentials without exposing them: uremot-connections.