ISOMORPH

Getting your credentials

Your agent operates under your own credentials so its work is attributed to you. You enter each token once during onboarding; it goes straight into your agent's encrypted secret and is never persisted in the request or logged.

01

Claude Code OAuth token (required)

This authorizes the agent's Claude Code runtime against your Claude subscription. The agent will not run any task until this token is set.

  1. Install the Claude Code CLI if you haven't already (installation guide).
  2. Run claude setup-token in your terminal and complete the browser login.
  3. Copy the token it prints — it starts with sk-ant-. Paste it into the Claude Code token field on the onboarding form.
⚠ Note:Treat this token like a password. If it leaks, re-run claude setup-token to issue a new one and re-onboard the agent with the new value.
02

Slack tokens (required)

Slack is how you talk to your agent, so these are required in practice. You need a bot token (xoxb-) and an app-level token (xapp-) for Socket Mode. The onboarding form generates a ready-to-paste Slack app manifest so you don't configure scopes by hand.

⚠ Note:The form will accept blank Slack fields, but the resulting agent has no way to reach you or be reached — it will sit idle until you add the tokens from the console's Credentials panel. Have them ready before you onboard.

The Slack app setup guide covers creating the app from the manifest, copying both tokens, and finding the Slack user IDs for your agent's allowlist.

03

GitHub personal access token (optional)

Supply a GitHub PAT if the agent should read or write your repositories. Without it, the agent can still work on public repos and local files, but cannot push to or clone private ones.

Fine-grained token (recommended)

  1. Go to GitHub → Settings → Developer settings → Fine-grained tokens.
  2. Scope it to only the repositories the agent should touch.
  3. Under Repository permissions, grant Contents: Read and write and Pull requests: Read and write (add Issues if the agent should manage issues).
  4. Generate the token and copy it — it starts with github_pat_.

Classic token

A classic token (starts with ghp_) with the repo scope also works, but grants access to all your repositories — fine-grained is safer.

ℹ Info:Paste the token into the GitHub PAT field on the onboarding form. Set an expiry you're comfortable with — you can replace it at any time from your agent's Credentials panel in the console, without re-onboarding. A replaced credential takes effect on the agent's next task.
04

AWS access keys (optional)

Supply AWS credentials if the agent should build or operate infrastructure in your account — deploying a site, provisioning a database, or reading CloudWatch to diagnose an incident. Creating a dedicated IAM user, deciding how much it may do, and setting a spending guardrail are covered in their own guide: Linking an AWS account.

Where your credentials live

When you submit the onboarding form, each token is written to your agent's dedicated secret in AWS Secrets Manager (encrypted with a per-tenant key) and is never written to the provision request stored in S3, never returned in an API response, and never logged. Read more in Security.

Got your tokens?

With your Claude Code token and Slack tokens ready — plus any optional GitHub or AWS credentials — you can onboard your agent.

Onboard an Agent →