Inject credentials

Once you’ve pushed secrets and provider credentials to the vault (see Manage secrets), you decide which ones get injected into each new rig. Amika supports three patterns:

Env-var secrets — generic secrets exposed as environment variables.
Pinned agent credentials — pick a specific Claude / Codex credential.
Skip an agent kind — opt out entirely for one kind.

Step 1 — Inject env-var secrets

Map a rig env var to a secret stored in the vault.

# Map a specific env var to a secret by name
amika rig create --name dev-box \
  --secret env:ANTHROPIC_API_KEY=my-claude-key

# Shorthand: env var name matches the secret name
amika rig create --name dev-box --secret env:DATABASE_URL

await amika.createRig({
  name: "dev-box",
  secretEnvVars: {
    ANTHROPIC_API_KEY: "my-claude-key",
    DATABASE_URL: "database-url",
  },
});

Step 2 — Pin a specific agent credential

If you have multiple credentials for the same agent (e.g. both an OAuth and an API-key credential for Claude), pin which one to inject. Pin by name or by type.

# Pin by stored credential name
amika rig create --name dev-box \
  --agent-credential claude=personal-oauth

# Pin by type — let the server pick a matching credential
amika rig create --name dev-box \
  --agent-credential-type claude=api-key

await amika.createRig({
  name: "dev-box",
  agentCredentials: [
    { kind: "claude", name: "personal-oauth" },
    // Or pin by type:
    // { kind: "claude", type: "api_key" },
  ],
});

Step 3 — Skip an agent kind entirely

Opt out of credential injection for one agent kind.

amika rig create --name dev-box \
  --no-agent-credential codex

await amika.createRig({
  name: "dev-box",
  agentCredentials: [{ kind: "codex", none: true }],
});

Inspect what actually got injected

The rig response includes a resolvedAgentCredentials field that shows, per kind, the outcome (resolved or skipped), the source, and a reason. Use it to confirm the right credential made it into the rig.

const sb = await amika.getRig("dev-box");
for (const c of sb.resolvedAgentCredentials ?? []) {
  console.log(c.kind, c.outcome, c.name, c.source, c.reason);
}

Example:

claude resolved personal-oauth user_default ""
codex  skipped  ""            no-credential "no-agent-credential flag"

Picking from the web UI

The New rig form on app.amika.dev lets you pick the credential per kind from a dropdown. The CLI flags and SDK options above are the scriptable equivalent of that picker.

Combining flags

--agent-credential and --agent-credential-type may both appear for the same kind — they narrow by both name and type.
--no-agent-credential is mutually exclusive with the other two flags for the same kind.
Each flag may appear at most once per kind.

Supported kinds today: claude, codex. Type values: oauth and api_key (the CLI also accepts the hyphenated api-key).

Get started

VM Rigs

Agents and sessions

Configuration

Connecting to rigs

Code validation

Guides for agents

Advanced

Inject credentials

Step 1 — Inject env-var secrets

Step 2 — Pin a specific agent credential

Step 3 — Skip an agent kind entirely

Inspect what actually got injected

Picking from the web UI

Combining flags

Next steps

Manage secrets

Send a message to an agent

Rig configuration reference

​Step 1 — Inject env-var secrets

​Step 2 — Pin a specific agent credential

​Step 3 — Skip an agent kind entirely

​Inspect what actually got injected

​Picking from the web UI

​Combining flags

​Next steps

Manage secrets

Send a message to an agent

Rig configuration reference

Step 1 — Inject env-var secrets

Step 2 — Pin a specific agent credential

Step 3 — Skip an agent kind entirely

Inspect what actually got injected

Picking from the web UI

Combining flags

Next steps