> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryreplicas.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> Configure coding agents and integrations.

Credentials control which coding agents and integrations are available to your workspaces.

## Coding Agents

Configure coding agents in [Organization → Coding Agents](https://tryreplicas.com/dashboard/agents).

Organization admins can expand **Models** under Claude, Codex, or Cursor, or **OpenRouter models** under Opencode or Pi, to choose which models appear in workspace, automation, and default-setting pickers. All supported Claude and Codex models remain visible until an admin changes the selection.

Organization admins can also choose which coding agents can handle delegated tasks. Each selected agent must have credentials available in the workspace.

| Agent           | Authentication                                                     |
| --------------- | ------------------------------------------------------------------ |
| **Claude Code** | Claude OAuth, Anthropic API key, Microsoft Foundry, or AWS Bedrock |
| **Codex**       | OpenAI OAuth, OpenAI API key, or Microsoft Foundry                 |
| **Opencode**    | OpenCode Go, Aster, or OpenRouter API key                          |
| **Pi**          | Aster or OpenRouter API key shared with Opencode                   |
| **Cursor**      | Cursor API key                                                     |

At least one coding agent must be configured before creating workspaces.

See the [Claude Code](/features/coding-agents/claude-code), [Codex](/features/coding-agents/codex), [Cursor](/features/coding-agents/cursor), [Opencode](/features/coding-agents/opencode), and [Pi](/features/coding-agents/pi) guides for agent-specific setup and usage.

### Anthropic API Key Alternative

Use an Anthropic API key (starts with `sk-ant-`) if you do not want to connect Claude OAuth.

### OpenAI API Key Alternative

Use an OpenAI API key if you do not want to connect OpenAI OAuth for Codex.

### OpenRouter API Key

Use one OpenRouter API key (starts with `sk-or-`) for Opencode and Pi. The shared credential appears under **Opencode → OpenRouter API Key** and **Pi → OpenRouter API Key**. Create one from the [OpenRouter keys page](https://openrouter.ai/keys).

### OpenCode Go

Open **Opencode → OpenCode Go** under Coding Agents and paste an API key from OpenCode Zen. Configure it at the organization level for shared access or at the personal level for one user.

### Aster API Key

Use one Aster API key (starts with `sk_aster_`) for Opencode and Pi. Create one in the [Aster console](https://console.asterlab.ai/) and paste it under either agent. Within a [scope](#scopes), Opencode prefers OpenCode Go, then Aster, then OpenRouter; Pi prefers Aster, then OpenRouter.

### Opencode

Use Opencode with an OpenCode Go, Aster, or OpenRouter API key. See the [Opencode agent guide](/features/coding-agents/opencode) for setup details, models, and usage.

### Pi

Use Pi when you want its SDK-backed tool and skill harness with Aster or OpenRouter models. See the [Pi agent guide](/features/coding-agents/pi) for setup details and usage.

### Cursor API Key

Use a Cursor API key to run Cursor agents. Cursor proxies many models (Composer, Claude, GPT, Gemini, Grok, and more); admins pick which appear in the picker. When an organization Cursor API key is connected, Replicas loads that key's available model catalog for the picker. See the [Cursor agent guide](/features/coding-agents/cursor) for setup details and usage.

### Microsoft Foundry Alternative

Use [Microsoft Foundry](https://learn.microsoft.com/en-us/azure/foundry/) to run Claude Code or Codex against Azure-hosted deployments:

* **Claude Code** requires a Foundry API key and resource name, plus optional Sonnet, Haiku, and Opus deployment names.
* **Codex** requires an Azure OpenAI API key, a base URL (for example `https://your-resource.openai.azure.com/openai/v1`), and a model deployment name.

### Bedrock Alternative

If you prefer AWS Bedrock for Claude, provide your AWS credentials instead of Claude OAuth. Bedrock credentials require:

* Access Key ID
* Secret Access Key
* Region

## Scopes

Credentials can be set at two levels:

| Scope            | Description                                   |
| ---------------- | --------------------------------------------- |
| **Organization** | Shared by all members, used as default        |
| **User**         | Personal credentials, takes priority over org |

Scope is checked before authentication method. If you have *any* personal credential for an agent, Replicas uses it, even when the organization has one the agent would otherwise prefer. A personal Anthropic API key beats an organization Claude account. Method order only decides between credentials in the same scope.

Only organization admins can manage organization-level credentials. Non-admin members can see whether org credentials are configured but cannot view or edit them.

Set personal credentials under **Personal**: coding agent keys in [Coding Agents](https://tryreplicas.com/dashboard/account/agents) and provider connections in [Integrations](https://tryreplicas.com/dashboard/account/integrations).

[`replicas claude-auth`](/features/cli#connect-a-coding-agent-account) and `replicas codex-auth` save at the user level unless an admin passes `--org`. Both commands print the scope for confirmation before saving.

## How Credentials Are Used

When a workspace is created, Replicas identifies the user and uses their credentials if available, falling back to organization credentials. Every agent resolves credentials the same way, so [scope precedence](#scopes) and method order behave identically for all of them.

### Coding Agent Auth Fallback

[Scope](#scopes) is decided before auth method: **every credential you own is tried first, and the organization's are used only if you have none.** Method order breaks ties within a single scope.

* **Claude**: OAuth, then [Anthropic API key](#anthropic-api-key-alternative), then [Microsoft Foundry](#microsoft-foundry-alternative), then [AWS Bedrock](#bedrock-alternative).
* **Codex**: OAuth, then [OpenAI API key](#openai-api-key-alternative), then [Microsoft Foundry](#microsoft-foundry-alternative).

So if the organization has a Claude account and you have your own Anthropic API key, your key wins and your work bills you rather than the organization.

When a workspace reports that its credential was rejected, Replicas force-rotates that credential first if it is OAuth, and moves on only if the provider rejects the refresh. Only the rejected credential is skipped: the same method in the other scope stays available, and a personal token failing never rotates the organization's shared one.

OAuth token refreshes are serialized per credential, so concurrent workspaces crossing the expiry threshold together no longer invalidate each other's tokens.

Workspaces also re-resolve credentials when waking from hibernation, so a workspace that was sleeping while the OAuth token rotated upstream picks up the latest credentials on wake instead of failing the first message. A workspace that resolves to a non-OAuth credential has any account login file from a previous owner removed, so a reused sandbox never authenticates as someone else.

### Authentication Retry Behavior

If Claude, Codex, or Cursor returns an authentication error mid-conversation (for example, an access token that expired between messages, a ChatGPT session that ended on Codex, or a revoked Cursor API key), the workspace pauses the chat instead of surfacing the raw error. An amber re-authentication pill appears above the composer and the textarea and Send button stay disabled while credentials are refreshed and your message is replayed automatically.

If every retry fails, Codex and Cursor chats show a "Couldn't authenticate" message for the selected agent. Claude chats show guidance for the selected credential method: reconnecting Claude OAuth, checking Anthropic API key validity, credits, and model access, or checking Bedrock credentials, region, IAM permissions, and model access. Check your credentials in [Personal → Coding Agents](https://tryreplicas.com/dashboard/account/agents), or [Organization → Coding Agents](https://tryreplicas.com/dashboard/agents) if you are an admin, and try again.

### From Linear

When you assign an issue to Replicas, it uses your connected Linear account to find your Replicas account. Connect it under [Personal → Integrations](https://tryreplicas.com/dashboard/account/integrations). Email matching remains a fallback. Your personal agent credentials and preferences are used if configured.

### From Slack

When you mention Replicas in Slack, it uses your connected Slack account to find your Replicas account. Connect it under [Personal → Integrations](https://tryreplicas.com/dashboard/account/integrations). Email matching remains a fallback.

### From GitHub

Your personal GitHub account is automatically connected when an admin connects GitHub at the organization level. When you mention `@tryreplicas` on a PR, Replicas identifies you by your GitHub login and uses your personal credentials.

If you need to reconnect or use a different GitHub or GitLab account, you can do so manually in [Personal → Integrations](https://tryreplicas.com/dashboard/account/integrations).

### From GitLab

When you mention `@tryreplicas` on a merge request or issue, Replicas identifies you by your GitLab username and uses your personal credentials. Connect your personal GitLab account from [Personal → Integrations](https://tryreplicas.com/dashboard/account/integrations) to attribute merge requests to you. See [GitLab integration](/features/gitlab).