> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bead.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud agent credential profiles

> Store cloud agent credential profiles and connect your human subscriptions through the dashboard.

Create cloud agent credential profiles to name and store sets of AI credentials. Store a profile once, then select its UUID at machine creation or when you send a runner prompt. Profile reads return metadata rather than secret values.

## Save an API credential

`profile-put` reads credential material from stdin. Replace `PROFILE_UUID` with a UUID you generated and keep the material in a private local file. For a simple API-key profile, its shape is:

```json theme={null}
{"env":{"OPENAI_API_KEY":"YOUR_PROVIDER_API_KEY"}}
```

```bash theme={null}
bead profile-put PROFILE_UUID --name coding < ./credential-material.json
bead profile-list
```

Supported simple environment names are `OPENAI_API_KEY`, `CODEX_API_KEY`, `ANTHROPIC_API_KEY`, and `CLAUDE_CODE_OAUTH_TOKEN`. The CLI bounds profile input to 64 KiB. Keep actual credentials out of shell arguments, logs, and reusable template inputs.

## Use the profile

```bash theme={null}
bead create --template agents --size small --profile PROFILE_UUID --timeout 900
bead prompt ID 'Inspect the repository' --cwd /root/project --profile PROFILE_UUID
```

Create the working directory first. Credential-bearing snapshots need explicit consent; read [snapshots](https://docs.bead.run/snapshots/overview.md).

## Connect human subscriptions

Use the vault in the [dashboard](https://app.bead.run) to connect supported Claude and Codex subscriptions. A profile can hold ordered provider accounts and API keys. Complete sign-in in the human browser and select the profile for the machine.

OpenClaw and Hermes receive complete credentials once in their native auth stores. The application owns refresh afterwards, so vault edits affect new app machines. A subscription in use by an app cannot be handed to another app or coding machine; a conflict identifies its owner. Use a separate sign-in for each running app machine. API keys can be reused.

After deleting an app machine, sign in again before central subscription refresh can resume: the app may have rotated the grant.

## Revoke or delete

```bash theme={null}
bead profile-revoke PROFILE_UUID
bead profile-delete PROFILE_UUID
```

Revocation prevents future profile use. Managed coding-agent removal is asynchronous. Copies already delivered to OpenClaw or Hermes require provider revocation or removal in the app.

Profile access does not give repository access. See [repository setup](https://docs.bead.run/use-cases/agent-on-repo.md) and [worktree environment](https://docs.bead.run/worktrees/environment.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.