Skip to main content
Create cloud agent credential profiles to name and store sets of AI credentials. Store a profile once, then select its UUID at machine creation or when you send a runner prompt. Profile reads return metadata rather than secret values.

​
Save an API credential

profile-put reads credential material from stdin. Replace PROFILE_UUID with a UUID you generated and keep the material in a private local file. For a simple API-key profile, its shape is:
Supported simple environment names are OPENAI_API_KEY, CODEX_API_KEY, ANTHROPIC_API_KEY, and CLAUDE_CODE_OAUTH_TOKEN. The CLI bounds profile input to 64 KiB. Keep actual credentials out of shell arguments, logs, and reusable template inputs.

​
Use the profile

Create the working directory first. Credential-bearing snapshots need explicit consent; read snapshots.

​
Connect human subscriptions

Use the vault in the dashboard to connect supported Claude and Codex subscriptions. A profile can hold ordered provider accounts and API keys. Complete sign-in in the human browser and select the profile for the machine. OpenClaw and Hermes receive complete credentials once in their native auth stores. The application owns refresh afterwards, so vault edits affect new app machines. A subscription in use by an app cannot be handed to another app or coding machine; a conflict identifies its owner. Use a separate sign-in for each running app machine. API keys can be reused. After deleting an app machine, sign in again before central subscription refresh can resume: the app may have rotated the grant.

​
Revoke or delete

Revocation prevents future profile use. Managed coding-agent removal is asynchronous. Copies already delivered to OpenClaw or Hermes require provider revocation or removal in the app. Profile access does not give repository access. See repository setup and worktree environment.