Manage AI keys and credentials

A Credential profile in AI Key Management holds sensitive connection data for a model provider or local LLM. It is not a personal password vault or general-purpose secret store. Never copy its values into Chat, playbooks, documents, or logs. See secret boundaries.

Permissions and identity

Listing, creating, rotating, applying, and deleting can require different permissions. Tenant and platform super administrators may have role-based bypasses; other users need all relevant Credential and Agent actions. Seeing the screen does not grant access to every button.

Platform super administrators can filter profiles by tenant. When switching tenants, check the tenant, provider, fingerprint, and number of connected Agents, not just the key name.

Register a credential

1. Open Admin → Integrations → AI Key Management → Add Key.
2. Select provider and credential type.
3. Enter a name, then supply the credential or complete ChatGPT sign-in below before saving.
4. Check provider, type, fingerprint, version, and connected Agent count.

Options include Claude API key or setup token, OpenAI API key, OpenAI Codex ChatGPT sign-in or auth.json, Google Gemini API key, OpenRouter API key, Ollama server, and OpenAI-compatible local LLM server. Actual options depend on release and permissions.

Ollama takes a server address and model, not an API key. OpenAI-compatible local servers can accept an API key if needed. A successful connection test does not prove Agent runtime access; verify a non-sensitive prompt on the Agent too.

Obtain provider API keys

ClawPod does not issue provider keys. Create one in your provider account or project, store it according to organization secret-handling procedures, and enter it only in the Credential input.

Provider	Issuing console	Value for ClawPod
Anthropic Claude	Anthropic Console	API key; setup tokens can be stored but not bound to Agents
OpenAI	OpenAI API keys	Project API key
Google Gemini	Google AI Studio	Gemini API key
OpenRouter	OpenRouter API keys	OpenRouter API key

Choose the intended organization/project and set minimum permissions, budgets, and billing with the provider. The Official console link opens the corresponding issuing page. Provider menus and billing terms can change, so fixed button sequences are not reproduced here.

The full value may not be shown again. Never paste it into Chat, Tasks, workspace files, screenshots, or support requests. If exposure is suspected, revoke the old key at the provider as well as replacing it in ClawPod.

Connect OpenAI Codex with ChatGPT sign-in

OpenAI Codex offers Sign in with ChatGPT (Recommended) and Register auth.json. For an ordinary OpenAI API key, choose OpenAI as the AI service. Signing in to ClawPod is separate from connecting the ChatGPT account an Agent will use.

Sign in with ChatGPT — recommended

1. Open Admin → Integrations → AI Key Management → Add Key.
2. Choose OpenAI Codex as the AI service and enter a Key name.
3. Keep Sign in with ChatGPT selected and choose Continue with ChatGPT.
4. Note the Device code and choose Open ChatGPT sign-in page. Sign in to the intended ChatGPT account on the official page and enter the code.
5. Keep the ClawPod connection dialog open. Closing it while waiting cancels the connection.
6. When ChatGPT account connected. Save to finish. appears, select Add Key to save. Completing sign-in alone does not finish registration.
7. Check the saved name, OpenAI Codex provider, Codex Login type, and status in the list.
8. Select the saved Credential in the target Agent's AI Resource Settings, check application results, and verify a small request actually reaches the model.

This method does not require finding or copying a local auth.json. Use your own or an organization-authorized account. Keep passwords, device codes, and credentials out of guides and Chat.

Sign-in problems

• Expired device code: retry to obtain a new code.
• Device-code login not allowed: check ChatGPT security settings or ask the workspace administrator about permission. Follow organization policy. See the official OpenAI authentication guide.
• Waiting or checking: wait for completion; a failed login is not a saved connection.
• Expired connection or sign-in required: open Update for the saved key, complete ChatGPT sign-in again, and save. Check application results for connected Agents too.

Alternative: register auth.json

If you already signed in with Codex CLI on a trusted device, you can choose Register auth.json.

1. Run codex login on that device and sign in with your account.
2. If using file-based credential storage, paste the entire JSON from ~/.codex/auth.json into the manual input. If you changed CODEX_HOME, use that location.
3. Complete the form's format check and save steps, then connect the target Agent.

Codex may use the operating-system credential store instead of a file. Do not assume the file always exists; use Portal sign-in above or consult the official credential storage guide.

The manual input requires valid JSON with a top-level tokens object, not an ordinary API key. Manual auth.json registration does not automatically verify the ChatGPT connection. Distinguish successful storage from a successful Agent request. Update expired credentials after signing in again. Keep authentication files out of repositories, shared documents, issues, and Chat.

Connect an Agent

1. Select the Credential in the target Agent's settings.
2. Confirm the Agent and Credential belong to the same tenant.
3. Check for another credential conflicting in the same runtime slot.
4. Inspect whether application is updated, pending, or failed.
5. For pending or runtime warnings, check status and restart requirements, then verify a small request.

Claude setup tokens can be stored, but Agent binding accepts API keys only. To change provider or type, create a new profile and review the binding instead of assuming the old profile can be overwritten.

Rotate safely

1. Issue a new secret at the provider.
2. Check the profile fingerprint and Used by Agent list.
3. Open the profile and enter the new value. Provider, type, and profile name cannot be changed in the rotation screen.
4. Verify application results and Agent count, then test affected Agents.
5. Revoke the old provider secret after the new connection works.

The Portal does not reveal stored raw secrets. It shows identifying fingerprints and current versions. If a value is lost, issue and replace it rather than trying to retrieve it.

Disconnect and delete

A profile must have no connected Agents before deletion. Check Used by, replace or remove every binding, then delete. If deletion is rejected, check remaining bindings instead of repeatedly submitting.

Deleting a profile does not revoke the provider's API key. For exposure, departure, or contract termination, revoke it in the provider console too.

Troubleshooting

Check the binding, Agent settings, restart state, then provider account, quota, and connectivity. If problems remain, inspect a safe test Room and Agent logs. For suspected exposure, rotate immediately and restart affected Agents.

Creation and rotation rights follow organization policy. Never request or share another member's secret. Encryption-key creation, rotation, and recovery are not verified customer Portal self-service features and are not documented here as operational procedures.