Cloud agent credentials

Local agents authenticate in their own panes. Cloud and background agents run without your terminal, so Coldtea has to hold their credentials for them. This page covers the cloud-run settings: where the credentials live, how repository secrets and defaults work, and what the local setup scan does.

These settings sit under Cloud runs in Settings. The credential source and subscriptions are stored per TeaHouse; repository secrets, the default base branch, and launch defaults are stored per repository.

Credential source

The "Agent credentials" group asks you to "Pick a credential source for cloud agents". It is a short list of two rows, not a toggle:

• API keys: "Use saved provider keys".
• Subscription: "Use your Claude or ChatGPT subscription".

Pick one. Each row shows its state on the right: "Current" for the saved source, "Save to apply" for a source you selected but have not saved, and "Choose" for the other one. Select "Save credentials" to apply; Coldtea confirms with "Cloud run credentials saved".

API keys

With API keys selected, each supported agent gets a field:

• Claude: sk-ant-…
• Codex: sk-…

A saved key shows "Saved" and a masked field reading "Saved · paste to replace"; an empty one shows "Missing". Paste a new value to replace a key, or remove it. Keys are write-only: Coldtea stores them and never shows them back.

Subscription

With Subscription selected, Coldtea shows the connect list for Claude and Codex. Connecting a subscription there uses your Claude or ChatGPT plan for cloud runs instead of a key. The per-agent flows (token paste for Claude, file detection for Codex) are covered on the Claude and Codex pages.

OpenCode sits in the same box but is not governed by the source above. It is a cliAuth agent, so it has its own connect row regardless of whether you chose API keys or Subscription. See OpenCode. Gemini has no cloud credential option.

Repository secrets

The "Repository secrets" group stores per-repo environment variables for cloud runs. The description says it plainly: "Choose the repository here, then save environment variables for that repo only." Pick the repository first; the section stays disabled until a repository is resolved.

Add a variable with a "Name" (for example ANTHROPIC_BASE_URL) and a "Value", then select "Add". Saved variables read "Copied into cloud runs only" and, like API keys, are write-only ("Saved · paste to replace"). Select "Save repository secrets" to apply.

Use this for values a cloud run needs that are specific to one repository, such as a custom API base URL or a service token.

Default base branch

The "Default base branch" group sets the branch cloud agents work from. The description spells out what it controls: "Agents branch off this and open pull requests against it, or leave empty to use the repo's default branch."

This is per repository and needs GitHub access for that repo. Until Coldtea confirms access, the field reads "Connect GitHub for this repository to set a default base branch". Leave it empty to use the repository's own default branch. See GitHub for connecting a repository.

Launch defaults

The "Launch defaults" group sets the model and reasoning effort cloud runs use: "Model and reasoning effort for cloud runs. Leave empty to inherit the agent CLI's own configured default."

Each API-key agent gets its own row with a model field and a reasoning-effort field. Leaving a field empty inherits the agent CLI's configured default. Select "Save launch defaults" to apply. These are the cloud-run equivalents of the local launch presets; OpenCode is not included here.

Local setup scan

The "Local setup scan" card reports what local agent configuration Coldtea syncs into cloud runs: "Skills, and MCP metadata synced for your agent cloud runs." Select "Rescan" to run it again.

The scan reads your local agent CLI profiles for the selected project (config, skills, MCP servers, commands, subagents, hooks, and more) and shows what it found per agent as "Detected" or "Not found". It is read-only. It authenticates nothing, and when it finds nothing it says so: "No local agent profiles found for supported CLIs. Nothing is uploaded." For more on the local tool surface, see MCP and local API.

Where to go next

• Claude, Codex, and OpenCode for the per-agent cloud flows.
• Launch presets for the local equivalent of launch defaults.
• GitHub to connect a repository for base-branch and PR settings.