PlatformSetup

Provider credentials

There are two kinds of credential in Coldtea, and it helps to keep them apart:

  • Agent auth: how an agent signs in to run. Coldtea manages this for Claude and stores it for cloud runs; every other local CLI signs in itself. The Connect agents pages cover it.
  • Provider credentials: the model-provider keys, subscriptions, and config an agent CLI uses to reach Anthropic, OpenAI, Google, or another backend when it runs in a local pane.

This page is about the second kind: provider credentials for local agent panes.

Local panes use the CLI's own provider setup

For a local pane, Coldtea launches the agent and the agent decides how to authenticate with its model provider. Coldtea does not need to store your provider key for a local pane, and it should not be treated as a second provider setup screen when the agent already owns that setup.

If a local agent needs a provider key, subscription, login, or config, set it up in the agent's normal flow. That may mean:

  • A browser login the agent opens.
  • A CLI auth command from the agent's own docs.
  • Environment variables inherited from your shell.
  • A provider config file the agent owns.
  • OpenCode's /connect flow in the pane.

Do not paste provider keys into task descriptions, prompts, shared logs, or screenshots.

Cloud runs are different

Cloud and background agents do not run in your terminal, so they cannot use a local login. Coldtea stores their credentials for you, per TeaHouse, as an API key or a subscription connection. That is a separate system from the provider setup a local pane uses. See Cloud agent credentials.

Check credentials safely

Before a real edit, start the agent and ask for a read-only action:

Say which model or provider you are using if the CLI exposes it, then inspect the repository structure. Do not edit files.

If the agent asks you to log in, complete the login in the agent's own prompt. If it prints an auth error, read the error from the terminal and follow that agent's setup docs.

Environment variables

Some agents read provider credentials from environment variables. A Coldtea-launched pane inherits your shell environment just like a normal terminal, so that path works. Keep secrets out of committed files: use local-only files or your shell's secret management.

For cloud runs, per-repository environment variables live in repository secrets, covered in Cloud agent credentials.

Team policy

For teams, agree on this before rollout:

  • Which provider accounts agents may use.
  • Whether production credentials are allowed in local agent panes.
  • Which secrets must never be pasted into shared Coldtea surfaces.
  • Who can connect cloud credentials for the TeaHouse.

The safest default is boring: local agents use least-privilege credentials, and a human reviews before anything ships.

Where to go next

Launch presets

The arguments Coldtea passes an agent when you start a pane, autonomy, model, reasoning effort, and extra flags, set once per agent.

Worktree scripts

Run setup when a new worktree needs more than git worktree add: prepare files, start a service, and clean up when the branch is done.

On this page

Local panes use the CLI's own provider setupCloud runs are differentCheck credentials safelyEnvironment variablesTeam policyWhere to go next