Step 1 — your coding-agent credential
The coding agent runs inside your container on your model account. PlatformSmith never supplies a model key, never proxies your prompts through an account of ours, and never bills you for tokens. So the first thing the platform needs from you is a credential it can hand to the agent.
Answer two questions in order: which agent, then which credential you have.
Which agent
| Agent | What it is |
|---|---|
| Claude Code | Anthropic's coding agent. Runs against Anthropic's API directly, or via Amazon Bedrock or Google Vertex AI. |
| Codex | OpenAI's coding agent. Runs against the OpenAI API, or on a ChatGPT subscription. |
Both run the same way inside the container and both are first-class. Pick the one whose account you already have.
Which credential
| Agent | Credential | Looks like | Personal only? |
|---|---|---|---|
| Claude Code | API Key | sk-ant-api03-… | no |
| Claude Code | OAuth Setup Token (a Claude subscription) | sk-ant-oat01-… | yes |
| Claude Code | AWS Bedrock | AWS access key pair + region | no |
| Claude Code | Google Vertex | a service-account credential + project | no |
| Codex | API Key | sk-… | no |
| Codex | ChatGPT Subscription | a subscription token | yes |
Where to get each one:
- Anthropic API key — the Anthropic Console, under API keys.
- Claude OAuth setup token — generated from a signed-in Claude Code CLI on your own machine. It represents your Claude subscription, which is why it can only ever be personal.
- AWS Bedrock — an IAM principal in your AWS account with Bedrock model access in the region you choose.
- Google Vertex — a service account in your GCP project with Vertex AI access.
- OpenAI API key — the OpenAI platform API keys page.
- ChatGPT subscription — from a signed-in Codex CLI, the same way as Claude's setup token.
An OAuth setup token and a ChatGPT subscription token represent one human's subscription. The platform enforces that: they can only be stored as personal credentials, and they can never become the organization's shared credential. If you need every member and every automated session in the organization to be able to run agents, you need an API key, a Bedrock or a Vertex credential.
Personal and shared
A credential is stored either on your account (personal) or on the organization (shared).
- Personal — yours, follows your account, and is used first for sessions you start.
- Shared — configured once by an owner or admin and usable by the whole organization.
Resolution is personal-first for the owning user: if you have a personal credential, your own sessions use it; everyone else falls back to the organization's shared one. Sessions that no human started — an alert-triggered run, a service principal — have no personal credential to resolve, so they require a shared one. An organization whose only credential is somebody's personal subscription token can run interactive sessions and nothing else.
Credentials and secrets covers the rest of the model.
The rule that surprises people
When a runtime starts, PlatformSmith resolves your coding-agent credential once and freezes it into that runtime instance. Changing, rotating or deleting the credential afterwards does nothing to a container that is already running — and nothing to the sessions inside it.
To pick up a changed credential you need a fresh runtime. Not a restarted session, not a reconnect: a new runtime.
This is the single most common source of "I rotated the key and it is still using the old one".
What connecting one also does
It picks your organization's default coding agent. You start with two
agent definitions — Default (Claude Code) and Default (Codex) — and neither is
the default, because at signup nobody had configured a credential and choosing would have been a
guess.
Connecting a credential here flags the matching one. Connect Codex and Default (Codex) becomes your
default; connect Claude and Default does. You do not have to go and set it yourself.
So connect the credential for the coding agent you actually intend to use. If you later want the other one, set the default from that definition's own page — adding a second credential does not move it.
A valid credential that leaves the step outstanding is almost always one of two things: it is a shared credential that was assigned to specific workspaces and not to this one, or it is for a different coding agent than your organization's default. → I added a valid credential and the checklist still says to connect one