> ## Documentation Index > Fetch the complete documentation index at: https://docs.zode.dev/llms.txt > Use this file to discover all available pages before exploring further. # Connect a provider key > Connect (or replace) the caller's key for a provider. Write-only. Sealed with ZODE_SECRETS_KEY (AES-256-GCM, bound to user and provider); 503 `secrets_unavailable` when the server has no key. Usable by every harness that accepts the provider. Audited as `agent.credential.set` with `provider` and `replaced`, never the key. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/agents/credentials openapi: 3.1.0 info: title: Zode API version: 0.1.0 description: Sandboxes for coding agents. Every route takes an API key as a bearer token. servers: - url: https://api.zode.dev security: - bearerAuth: [] tags: - name: Sandboxes - name: Commands - name: Browser and desktop - name: Snapshots - name: Images - name: Environments - name: Flight recorder - name: Attestation - name: Agents - name: Proxying - name: Webhooks - name: OpenTelemetry - name: Alerts - name: CI - name: Usage and billing - name: Workspace - name: Platform paths: /v1/agents/credentials: post: tags: - Agents summary: Connect a provider key description: |- Connect (or replace) the caller's key for a provider. Write-only. Sealed with ZODE_SECRETS_KEY (AES-256-GCM, bound to user and provider); 503 `secrets_unavailable` when the server has no key. Usable by every harness that accepts the provider. Audited as `agent.credential.set` with `provider` and `replaced`, never the key. operationId: putAgentCredential requestBody: required: true content: application/json: schema: type: object additionalProperties: false required: - provider - api_key properties: provider: type: string enum: - anthropic - openai - openrouter - gemini - deepseek - bedrock - vertex api_key: type: string minLength: 8 maxLength: 16384 writeOnly: true description: >- An API key (8-512 visible characters). Bedrock: a Bedrock API key, up to 4096. Vertex: a service account JSON file (up to 16 KB) or a Vertex API key. responses: '200': description: Updated agents view content: application/json: schema: type: object required: - harnesses - credentials - default_harness - secrets_available properties: harnesses: type: array items: type: object required: - id - name - providers - connected_via - connected - default - default_model - models - auth_method - subscription properties: id: type: string enum: - claude-code - codex - opencode - pi - kimi-code name: type: string providers: type: array items: type: string connected_via: type: array items: type: string connected: type: boolean default: type: boolean default_model: type: - string - 'null' models: type: array items: type: object required: - id - provider properties: id: type: string provider: type: string auth_method: type: string enum: - api_key - subscription description: How the harness signs in now (one at a time) subscription: description: >- Null for OpenCode and when the kill switch has it off. oneOf: - type: 'null' - type: object required: - kind - name - connected - hint - account_email - connected_at - method - sign_in properties: kind: type: string enum: - claude - chatgpt name: type: string connected: type: boolean hint: type: - string - 'null' description: >- Last 4 characters (Claude token, ChatGPT account id) account_email: type: - string - 'null' description: From the Codex id_token when present connected_at: type: - string - 'null' format: date-time method: type: - string - 'null' enum: - paste - sign_in - null sign_in: oneOf: - type: 'null' - $ref: '#/components/schemas/SubscriptionSignIn' credentials: type: array items: type: object required: - provider - name - connected - hint - connected_at - used_by properties: provider: type: string name: type: string connected: type: boolean hint: type: - string - 'null' description: Last 4 characters connected_at: type: - string - 'null' format: date-time used_by: type: array items: type: string default_harness: type: - string - 'null' secrets_available: type: boolean sign_in_sandbox: description: >- Where one-click subscription sign-in runs (the caller's newest running sandbox); null means paste only. oneOf: - type: 'null' - type: object required: - id - name properties: id: type: string name: type: string '400': $ref: '#/components/responses/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '503': $ref: '#/components/responses/Error' components: schemas: SubscriptionSignIn: type: object description: One one-click subscription sign-in. Never terminal output. required: - id - harness - sandbox_id - sandbox_name - state - url - user_code - needs_code - expires_at - error properties: id: type: string harness: type: string enum: - claude-code - codex sandbox_id: type: string sandbox_name: type: string state: type: string enum: - starting - waiting - finishing - connected - failed - expired - cancelled url: type: - string - 'null' description: >- The provider's sign-in page, as the CLI printed it (provider hosts only) user_code: type: - string - 'null' description: Codex one-time device code needs_code: type: boolean description: Claude waits for the code its page shows expires_at: type: string format: date-time error: type: - string - 'null' Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string examples: - not_found - rate_limited - plan_required description: | Stable machine code; branch on it rather than on `message`. Deliberately not a closed enum: new codes are added over time, so treat an unknown code by its HTTP status. The codes in use, by status (a few appear under two): - 400: `bad_request` (malformed JSON or unknown field), `invalid_request`, `bad_signature`, `confirm_required`, `default_environment`, `email_not_allowed`, `endpoint_required`, `invalid_code`, `invalid_email`, `invalid_image`, `invalid_name`, `invalid_nonce`, `invalid_state`, `invalid_token`, `not_admin`, `order_mismatch`, `org_required`, `owner_cannot_leave`, `password_too_long`, `password_too_short`, `personal_workspace`, `same_email`, `secret_unsupported`, `self`, `too_many`, `unknown_channel`, `unknown_environment`, `unknown_installation`, `url_not_allowed`, `use_transfer` - 401: `unauthorized`, `invalid_credentials`, `bad_signature` - 402: `plan_required` (the plan does not include it), `credit_exhausted` (no credit left and no card on file) - 403: `forbidden` (the role may not), `token_scope`, `csrf`, `cors`, `email_unverified`, `installation_not_yours`, `no_user`, `not_yours`, `subscriptions_off`, `wrong_account`, `wrong_password` - 404: `not_found`, `code_not_found`, `invalid_invite`, `not_configured`, `unknown_node`, `unknown_org`, `unknown_sandbox` - 409: `invalid_state` (wrong sandbox status), `concurrency_limit` (plan's running-sandbox cap), `daily_cap_reached` (workspace daily spend cap), `limit_reached`, `name_taken`, `node_full`, `not_running`, `browser_off`, `desktop_off`, `already_deleted`, `already_linked`, `already_member`, `already_on_plan`, `billing_not_open`, `checkout_required`, `code_not_applicable`, `code_redeemed`, `code_taken`, `endpoint_disabled`, `installation_taken`, `invite_pending`, `last_method`, `no_sandbox`, `not_placed`, `not_waiting`, `sandboxes_running`, `sole_owner`, `too_many_keys`, `trial_unavailable`, `trial_used` - 410: `expired`, `used`, `expired_token`, `expired_invite`, `code_expired`, `code_used_up` - 413: `too_large` - 415: `unsupported_media_type` - 429: `rate_limited` (see the RateLimited response), `too_many_viewers` (desktop viewers) - 500: `internal` - 501 (this server or host cannot do it yet): `feature_unavailable`, `attach_unavailable`, `exec_unavailable`, `snapshots_unavailable`, `images_unavailable`, `recorder_unavailable`, `attestation_unavailable` - 502: `node_error`, `host_unreachable`, `key_destroy_failed`, `provider_error`, `github_error`, `recorder_error` - 503: `no_capacity`, `unhealthy`, `alerts_unavailable`, `auth_unavailable`, `ci_unavailable`, `email_unavailable`, `ingest_unavailable`, `secrets_unavailable`, `webhook_not_ready` The device-flow code and token endpoints answer 400 in the RFC 6749/8628 shape instead (OAuthError). message: type: string responses: Error: description: Error content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: zode_tok_<64 hex chars> description: >- An API key (`zode_tok_...`). Create one in the console under API keys (https://console.zode.dev/tokens), or with `zode login`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.