Manage model accounts and secrets
Connect a model account, resolve credential errors, and choose where secrets are available.
Repository credentials let a task read or change code. Model accounts let the agent use a provider's models. Environment secrets supply values such as application tokens. Configure each connection for the work that needs it. Never paste a token into task instructions to bypass a missing connection.
Connect an organization model account
As an owner or admin, open Credentials and select Models. Choose Add API key or Connect subscription, then select a provider offered by that form. Complete the connection and check its Health result before starting a run. The available choices depend on the provider and authentication methods Devboxes supports.
An organization can have several accounts for the same provider. Give each account a name that identifies its purpose. A run that selects an organization account records its account ID and credential version.
Resolve an account problem
Open the account's row in Credentials, under Models, and read its Health details. Follow the action shown for that account:
| Account state | Action |
|---|---|
| Invalid credentials or Reconnect required | Choose Reconnect. Complete the provider sign-in again, or replace the API key in the form. |
| Disabled | Choose Enable when the account is authorized for use again. Check the new health result. |
| Unavailable or rate-limited | Read the provider error. Resolve any account or quota issue with the provider. Choose Validate when the connection can be checked again. |
| Unsupported | Choose another provider or authentication method offered by the connection form. Repeated validation will not add support. |
After reconnecting or validating, confirm that the account is usable and the required model appears in the run's model selection. If the error remains, keep its wording for support and exclude the API key or sign-in token.
Use Disable to prevent new runs from selecting the account. Queued runs pinned to that account fail when a runner next claims them. Disconnect removes its active connection and is blocked while queued or running work still uses it. Check the confirmation for affected work before proceeding. Existing runs keep their recorded account history.
Configure credentials on a local runner
On a connected runner, run:
devboxes credentials setup
devboxes credentials statusThe setup menu offers subscription sign-ins, API keys, and references to local authentication files for the providers it supports. Select the connection your task needs, finish setup, and inspect its status. These local credentials are available to tasks executed by that machine.
The device credential store is encrypted. The registered machine retrieves its passphrase through an authenticated connection and holds it in memory. Anyone who controls that machine can still inspect credentials while a running process uses them.
Share local credentials with the organization
To copy eligible local credentials into organization storage, run:
devboxes credentials syncSync makes those credentials available beyond the original machine, including eligible cloud or other runner execution. Sync only accounts you are authorized to share with the organization.
This command does not copy OAuth sessions from another CLI's authentication file. Use a subscription sign-in offered by devboxes credentials setup to connect that account directly to Devboxes.
Add task environment secrets
For a single project, open Projects, select the project, and open Environment. Choose Add key, mark the value as a secret, and save it. For a value shared across projects, open Credentials, select Environment, and choose Add key. Assign the organization key to the projects that need it.
A run receives a snapshot of its configured environment. Later edits affect new snapshots, not runs that already have one. See project variables and inheritance for overrides and security for the access a task receives.