Getting your credentials

Your agent runs on your own Claude subscription, so its usage draws on your plan rather than being billed per token. It needs an active Claude Pro or Max subscription; a free account can sign in but cannot run an agent, and on a Teams or Enterprise plan an administrator must permit Claude Code first.

1. On the Claude OAuth step of onboarding, choose Authorize with Claude. A tab opens on Anthropic's site.
2. Sign in with the account whose subscription the agent should use and approve access.
3. Copy the short code Anthropic shows and paste it back into the form. The connection is verified on the spot.

A Claude connection lasts about a month and cannot be renewed automatically, so you will re-authorize it roughly monthly — from your agent's Credentials panel, the same flow: one click and a pasted code. We email you before it expires; you can tune those reminders in your account settings.

For developers only: paste a token from the terminal

If you already use the Claude Code CLI, claude setup-token prints a token that starts with sk-ant-oat. The onboarding form and the console's Credentials panel each have a For developers only option where it can be pasted. It grants nothing the Authorize button doesn't. A pasted token cannot be renewed, and the platform cannot see when it expires — expiry reminders do not track it(any reminder you receive refers to the last connection made with the button). When a pasted token stops working, re-authorize from the Credentials panel.

Slack is one way to talk to your agent — the console is the other — so these are needed only if you want the agent in your Slack workspace. You need a bot token (xoxb-) and an app-level token (xapp-) for Socket Mode. The onboarding form generates a ready-to-paste Slack app manifest so you don't configure scopes by hand.

The Slack app setup guide covers creating the app from the manifest, copying both tokens, and finding the Slack user IDs for your agent's allowlist.

Supply a GitHub PAT if the agent should read or write your repositories. Without it, the agent can still work on public repos and local files, but cannot push to or clone private ones.

Fine-grained token (recommended)

1. Go to GitHub → Settings → Developer settings → Fine-grained tokens.
2. Scope it to only the repositories the agent should touch.
3. Under Repository permissions, grant Contents: Read and write and Pull requests: Read and write (add Issues if the agent should manage issues).
4. Generate the token and copy it — it starts with github_pat_.

Classic token

A classic token (starts with ghp_) with the repo scope also works, but grants access to all your repositories — fine-grained is safer.

Supply AWS credentials if the agent should build or operate infrastructure in your account — deploying a site, provisioning a database, or reading CloudWatch to diagnose an incident. Creating a dedicated IAM user, deciding how much it may do, and setting a spending guardrail are covered in their own guide: Linking an AWS account.

When you submit the onboarding form, each token is written to your agent's dedicated secret in AWS Secrets Manager (encrypted with a per-tenant key) and is never written to the provision request stored in S3, never returned in an API response, and never logged. Read more in Security.