---
title: "Credentials"
description: "How sandbox-agent discovers and exposes provider credentials."
icon: "key"
---

`sandbox-agent` can discover provider credentials from environment variables and local agent config files.

## Supported providers

- Anthropic
- OpenAI
- Additional provider entries discovered via OpenCode config

## Common environment variables

| Variable | Provider |
| --- | --- |
| `ANTHROPIC_API_KEY` | Anthropic |
| `CLAUDE_API_KEY` | Anthropic fallback |
| `OPENAI_API_KEY` | OpenAI |
| `CODEX_API_KEY` | OpenAI fallback |

## Extract credentials (CLI)

Show discovered credentials (redacted by default):

```bash
sandbox-agent credentials extract
```

Reveal raw values:

```bash
sandbox-agent credentials extract --reveal
```

Filter by agent/provider:

```bash
sandbox-agent credentials extract --agent codex
sandbox-agent credentials extract --provider openai
```

Emit shell exports:

```bash
sandbox-agent credentials extract-env --export
```

## Notes

- Discovery is best-effort: missing/invalid files do not crash extraction.
- v2 does not expose legacy v1 `credentialsAvailable` agent fields.
- Authentication failures are surfaced by the selected ACP agent process/agent during ACP requests.