Agent credential issues

Use this page when Claude Code, Codex, Cursor, OpenCode, or another agent can't authenticate, won't launch, or shows as needing setup.

Each agent reaches models through its own CLI login, one of your API keys, or the Proliferate gateway. Pick the method per agent and surface in Settings → Agents → [agent] → Authentication.

Check:

• The agent works outside Proliferate first. If claude, codex, or the CLI you're using can't log in on its own, Proliferate can't fix that for you.
• Local vs. cloud uses different material. A local workspace can read your machine's native login state (.claude/.credentials.json, .codex/auth.json, and similar). A cloud workspace uses an API key or the gateway; it cannot run an interactive CLI login. If an agent works locally but fails in the cloud, check the Cloud surface separately.
• The selected Method matches what you intend. Choosing Proliferate gateway routes the agent through Proliferate-managed model access; choosing API key uses the key wired below that card; CLI login uses the agent's native Local credentials. Claude, Codex, and Grok use one method at a time. OpenCode can combine native providers, keys, and the gateway.
• The credential is scoped correctly. Personal credentials are yours alone. A teammate who shares a credential with your organization has to do that explicitly; you can't use someone else's login just because you're in the same org.
• The agent shows as ready, not "needs setup." Settings surfaces agents that still need attention in one place, with the specific missing piece (login, API key, or gateway access) called out per agent.

If everything above checks out but the failure only happens in a cloud workspace, move on to cloud workspace issues. If it's specifically GitHub access (cloning, PRs, pushing) that's failing, that's covered separately in Git and PR issues.

For the full model behind gateway routing, BYOK, and OAuth, see agents/authentication.