Skip to main content
For sandbox credential security, keep bead account keys, provider credentials, and possession links in private storage. Give each workload only the authority it needs.

​
bead API credentials

The CLI saves credentials in private files with mode 0600. It reads BEAD_API_KEY before a saved file. Use a secret manager for automation and avoid printing the environment in logs. Saved JSON credentials include the API origin. A credential for one origin is rejected when the CLI selects another origin. Use the shipped CI key issuer for CI automation. Check scope, expiry, and key budget before assigning a credential.

​
Provider profiles and subscriptions

Use AI credentials and vault to supply supported provider material. A human connects a Claude or ChatGPT subscription through Agents & credentials at app.bead.run. Keep that human sign-in step separate from an agent’s account signup. A subscription credential can be owned by an active machine. If the API reports that it is in use, follow the returned guidance to sign in again for another account. Deleting the machine does not restore a stale vault grant.

​
Worktree environment values

Worktrees inject allowed laptop env files or encrypted project-vault values into process environments. They do not copy the dotenv file into the guest. Project and service scope control which managed commands receive stored values. Keep values out of command arguments. Reserved loader and shell variables are rejected. See Environment files and project vault. Treat ownership claim links, desktop invitation links, and preview links as private capabilities. Share them only with the intended recipient and revoke access through the feature that issued the link. Preserve signup and purchase recovery files privately. Purchase recovery needs the original possession state and delivery key. A hosted Checkout URL is the only payment material a human needs from the agent.

​
Snapshots retain secrets

Plain environment values, files, browser sessions, and process heaps can persist in snapshots and forks. Removing a local file or revoking future credential delivery does not erase existing captures. Review and retire retained snapshots separately.