Cloud agent credentials

Local agents authenticate in their own panes. Cloud and background agents run without your terminal, so Coldtea has to hold their credentials for them. This page covers the cloud-run settings: where the credentials live, how repository secrets and defaults work, and what the local setup scan does.

These settings sit under Cloud runs in Settings. The credential source and subscriptions are stored per TeaHouse; repository secrets, the default base branch, and launch defaults are stored per repository.

Credential source

Cloud agents draw on one credential source, and you pick which:

• API keys: provider keys you save in Coldtea.
• Subscription: your Claude or ChatGPT plan.

Choose one and save. The change applies to every cloud run after that.

API keys

With API keys selected, Claude and Codex each get a field for a provider key. Keys are write-only: Coldtea stores them and never shows them back, so a saved key reads as saved and you paste a new value to replace it.

Subscription

With Subscription selected, Coldtea shows connect rows for Claude and Codex so cloud runs can use your plan instead of a key. The two flows differ, and each is covered on its own page: Claude and Codex.

OpenCode sits in the same place but ignores the choice above, because it syncs your own sign-in rather than storing a credential. It has a connect row either way. See OpenCode. Gemini has no cloud credential option.

Repository secrets

Repository secrets are environment variables for cloud runs, saved against one repository at a time. Pick the repository first, then add each variable by name and value.

Use these for values a cloud run needs that are specific to one repository, such as a custom API base URL or a service token. Like API keys, they are write-only: paste a new value to replace one.

Default base branch

This sets the branch cloud agents work from. They branch off it and open their pull requests against it. Leave it empty to use the repository's own default branch.

It is set per repository and needs GitHub access for that repo, so connect the repository first. See GitHub.

Launch defaults

Launch defaults set the model and reasoning effort cloud runs use, per agent. Leave a field empty and the run inherits whatever that CLI is already configured to use.

These are the cloud-run equivalent of the local launch presets. OpenCode is not included.

Local setup scan

Coldtea can carry some of your local agent setup into cloud runs, so a cloud agent works the way your local one does. The scan looks at your agent CLI profiles for the selected project, including skills and MCP servers, and tells you what it found for each agent. Rescan when you change that setup.

The scan only reads. It authenticates nothing, and when there is nothing to find it tells you so and uploads nothing. See MCP and local API for the local tool surface.

Where to go next

• Claude, Codex, and OpenCode for the per-agent cloud flows.
• Launch presets for the local equivalent of launch defaults.
• GitHub to connect a repository for base-branch and PR settings.