Credentials

Credentials are delivered over SSH on standard input, never as command arguments.

Proxmox

Use a dedicated Proxmox user and a privilege-separated API token. Give it only the permissions needed to inspect, clone, configure, start, stop, and delete workspace LXCs, scoped to the template, pool, clone storage, and bridge or VNet. Do not grant host administration, console, permission-management, or broad root-level privileges.

The template may contain the controller's public SSH key and non-secret bootstrap configuration. It must not contain Proxmox tokens, GitHub tokens, private deploy keys, model-provider credentials, or personal login state.

GitHub

The controller mints a GitHub App installation token scoped to each requested repository and refreshes it before expiry. Configure the App with Contents: read/write and Pull requests: read/write.

Never place a token in a repository URL: Git and other tools can repeat URLs in errors that reach logs or the workspace timeline. Do not forward a personal SSH agent into an autonomous workspace.

Agent credentials

Credentials are managed per configured agent in the Agents tab, then written when a workspace is provisioned. A running workspace keeps the credential it received; rotate a credential and launch a new workspace to use the replacement.

A workspace with an agent credential can use that agent account for its lifetime. Limit controller access, use a private workspace network, and destroy workspaces promptly after the task completes.