Agent credentials
DELEGATE has no AI keys of its own. Every agent runs on a credential that you or your organization add under Agent credentials.
Kinds of credentials
Section titled “Kinds of credentials”| Engine | Credential |
|---|---|
| Claude Code | Claude Pro or Max subscription (sign in), or an Anthropic API key |
| Codex | ChatGPT plan (sign in with a device code), or an OpenAI API key |
| OpenCode | An API key of Anthropic, OpenAI, Google Gemini, OpenRouter, Azure OpenAI, or any OpenAI-compatible endpoint |
Azure OpenAI takes the endpoint of the resource
(https://<resource>.openai.azure.com) and, optionally, the names of the
deployments the agent may use. Without deployment names OpenCode offers its
standard model list, which works when each deployment carries its model’s name.
A credential is personal (only you use it) or belongs to the organization (everyone uses it; adding one needs the right to manage agents).
Which credential a workspace uses
Section titled “Which credential a workspace uses”When a workspace starts, DELEGATE takes the first of:
- the credential pinned on the workspace,
- your own credential for the engine,
- the organization’s credential for the engine.
The secret never enters the sandbox
Section titled “The secret never enters the sandbox”The engine in the sandbox gets a placeholder. DELEGATE’s egress proxy replaces it with the real key on its way to the model provider. For a ChatGPT plan, DELEGATE keeps the long-lived token and gives the sandbox short-lived ones only.
Signing in
Section titled “Signing in”- Claude: open the link, sign in, and paste the code you are shown.
- ChatGPT: open the link and enter the code that DELEGATE shows you.
When a provider stops accepting a sign-in, the credential shows Sign in again.