crewship credential

Manage credentials (API keys, tokens, secrets) used by AI agents.

crewship credential <subcommand> [flags]

Alias: crewship cred

Subcommands

Command	Description
`list`	List credentials in the workspace (paged by default)
`get`	Show credential details (value is never displayed)
`create`	Create a credential
`update`	Update a credential
`delete`	Delete a credential
`assign`	Assign a credential to an agent
`unassign`	Remove a credential from an agent
`bind`	Bind a credential to an env var slot in a scope
`bindings`	List credential → slot bindings
`unbind`	Remove a binding
`resolve`	Show which credential fills each slot for one agent
`field list`	List a credential’s custom fields (secret values are never shown)
`field set`	Add or update a field (`--plain` for a non-secret identifier)
`field remove`	Delete a field
`test`	Test a credential value before saving
`test-stored`	Test an already-saved credential against the provider API
`rotate`	Rotate a credential value with a grace-overlap window
`rotations`	List rotation history for a credential
`rotation-cancel`	End an ACTIVE rotation’s grace window early
`audit`	Show audit timeline (USE / ROTATE / TEST / REVOKE / REVEAL)
`reveal`	Show a credential’s value — interactive sign-in required
`reveal-policy`	Show or set the workspace reveal switch
`sensitivity`	Set a credential’s classification
`default-env-var`	Print the conventional env var name for a provider

`crewship credential list`

List all credentials in the workspace.

crewship credential list

Output columns: ID, NAME, TYPE, TIER, STATUS, AGENTS, SOURCE The SOURCE column shows who owns the row: user (operator-created via UI/CLI), system (auto-managed rows minted by manifest dispatch), or agent. When a row is provisioned for a service, the service slug is suffixed (e.g. system (github-bot)).

Flag	Default	Description
`--limit`	`0`	Page size, 1–500; enables cursor pagination when set.
`--cursor`	(unset)	Opaque cursor from a previous page.
`--search`	(unset)	Server-side substring filter for name or description.
`--tag`	(unset)	Server-side exact filter for a credential tag.
`--all`	`false`	Follow cursors and fetch every page.

Without --limit, the paged request uses a page size of 100. If more results remain, the next cursor is printed to stderr.

`crewship credential get`

Show credential details. The credential value is never displayed.

crewship credential get <name-or-id>

Output fields: ID, Name, Type, Provider, Status, Scope, Created.

`crewship credential create`

Create a new credential. The value is validated against the provider API before saving.

crewship credential create --name anthropic-key --type API_KEY --provider ANTHROPIC --value sk-ant-...
crewship credential create --name github-token --type SECRET --provider GITHUB --value-stdin

Flag	Type	Default	Description
`--name`	`string`	(required)	Credential name.
`--type`	`string`	(required)	Type: `SECRET`, `API_KEY`, `AI_CLI_TOKEN`, `CLI_TOKEN`, or `ENDPOINT_URL`.
`--provider`	`string`		Provider name. `crewship credential create --help` prints the recognised set (`ANTHROPIC`, `OPENAI`, `GITHUB`, `AWS`, `GCP`, `KUBERNETES`, …) — the list is not a whitelist, any string is accepted so a niche tool’s token can still be stored. `ANTHROPIC`, `OPENAI`, `GOOGLE`, `GITHUB`, `GITLAB`, `VERCEL`, `CURSOR` and `FACTORY` trigger live API validation against the provider’s authentication endpoint; every other value (including `NONE`) is saved without validation.
`--value`	`string`		Credential value. Visible in process list — prefer `--value-stdin`.
`--value-stdin`	`bool`	`false`	Read value from stdin (secure, no process list exposure).
`--env-var-name`	`string`		Environment variable name.
`--account-label`	`string`		Which account or instance this credential belongs to (`work`, `personal`, …). For a self-hosted GitHub/GitLab, set it to the forge’s host (`ghe.acme.internal`, `gitlab.acme.internal:8443`) — git links resolve a credential by host.
`--security-level`	`int`	`0`	Keeper security level: `0` (server default), `1` (low), `2` (medium), `3` (high), or `4` (critical; human approval required on every read).
`--auth-token`	`string`		`ENDPOINT_URL` only: bearer token sent to the endpoint; stored encrypted.
`--header`	`KEY=VALUE` (repeatable)		`ENDPOINT_URL` only: extra request header.
`--crews`	`string` (repeatable/comma-separated)		Scope to the listed crew slugs or IDs.
`--scope`	`string`		Visibility scope: `WORKSPACE` (default) or `CREW`; usually inferred from `--crews`.

Using --value exposes the credential in the process list. Use --value-stdin for secure input:

echo "sk-ant-..." | crewship credential create --name anthropic-key --type API_KEY --provider ANTHROPIC --value-stdin

Credential values are validated against the provider API automatically. If validation fails, you are prompted to confirm saving. OAuth tokens (sk-ant-oat*) and SECRET type credentials skip validation.

`crewship credential update`

Update a credential. Only changed flags are sent.

crewship credential update <name-or-id> --value new-key-value
crewship credential update anthropic-key --value-stdin

Flag	Type	Default	Description
`--name`	`string`		New credential name.
`--value`	`string`		New credential value.
`--value-stdin`	`bool`	`false`	Read new value from stdin.
`--account-label`	`string`		Which account or instance this credential belongs to; pass an empty value to clear it.
`--security-level`	`int`	`0`	Keeper security level: `0`-`4`; level 4 requires human approval on every read.
`--crews`	`string` (repeatable/comma-separated)		Replace crew scoping; an empty value clears it.
`--scope`	`string`		Visibility scope: `WORKSPACE` or `CREW`.

`crewship credential delete`

Delete a credential.

crewship credential delete <name-or-id>
crewship credential delete anthropic-key --yes

Flag	Short	Type	Default	Description
`--yes`	`-y`	`bool`	`false`	Skip confirmation prompt.

Agents that depend on this credential lose access immediately. Prompts for confirmation unless --yes is passed.

`crewship credential assign`

Assign a credential to an agent. The credential is injected as an environment variable into the agent’s container.

crewship credential assign <name-or-id> <agent-slug> --env-var-name ANTHROPIC_API_KEY

Flag	Type	Default	Description
`--env-var-name`	`string`	(required)	Environment variable name (e.g., `ANTHROPIC_API_KEY`).
`--priority`	`int`	`0`	Priority (1-10).
`--ttl`	`duration`	(unset)	Create a short-lived lease, for example `30m`, `2h`, or `24h`; maximum 30 days. Omit for a standing grant.

`crewship credential unassign`

Remove a credential from an agent.

crewship credential unassign <name-or-id> <agent-slug>

`crewship credential field`

Manage custom fields in addition to a credential’s main value. The parent has the alias fields; subcommands are list, set, and remove (rm and delete are aliases for remove). Secret field values are never returned.

crewship credential field list aws-prod
crewship credential field set aws-prod region --value eu-central-1 --plain
crewship credential field set aws-prod secret_access_key --value-stdin < key.txt
crewship credential field remove aws-prod region

field set flags are --value, --value-stdin, --plain, and --ordinal. Keys must be lower_snake_case. Without --plain, a field is encrypted and shown only as (secret) by field list; --plain is for identifiers such as regions, account IDs, and hosts.

`crewship credential bind`

Bind a credential to an environment variable slot in one scope. The credential’s name is the account (github-acme); the slot is what the agent reads (GH_TOKEN). Keeping them apart is what lets one workspace hold ten GitHub accounts — ten crews can each bind GH_TOKEN to a different one.

crewship credential bind <name-or-id> --slot GH_TOKEN [--crew <crew>|--agent <agent>]

Flag	Type	Default	Description
`--slot`	`string`	(required)	Environment variable the agent will read (e.g. `GH_TOKEN`).
`--crew`	`string`	—	Scope to one crew (slug or ID).
`--agent`	`string`	—	Scope to one agent (slug or ID).

No scope flag means workspace scope. --crew and --agent are mutually exclusive: a binding has exactly one scope. Within a scope a slot points at exactly one credential — binding a slot that is already taken returns 409 Conflict instead of replacing the existing row. Binding the same slot in a different scope is not a conflict.

crewship credential bind github-acme   --slot GH_TOKEN --crew acme
crewship credential bind github-globex --slot GH_TOKEN --crew globex
crewship credential bind npm-publish   --slot NPM_TOKEN

`crewship credential bindings`

The command also accepts the alias crewship credential binding-list. List bindings in the workspace.

crewship credential bindings [--crew <crew>] [--agent <agent>] [--credential <name-or-id>]

An empty list does not mean agents receive nothing: a credential with no binding is delivered under its own name, which is the pre-binding behaviour.

`crewship credential unbind`

Remove a binding, by id or by naming the slot and scope.

crewship credential unbind <binding-id>
crewship credential unbind --slot GH_TOKEN --crew acme

Flag	Type	Default	Description
`--slot`	`string`	—	Slot to unbind, when no binding id is given.
`--crew`	`string`	—	Crew that holds the slot (slug or ID).
`--agent`	`string`	—	Agent that holds the slot (slug or ID).

`crewship credential resolve`

Show the slot map one agent will actually boot with, and which rule produced each row. Values are never shown.

crewship credential resolve <agent-slug-or-id>

SLOT       CREDENTIAL     SOURCE
GH_TOKEN   github-acme    crew_binding
NPM_TOKEN  npm-publish    workspace_binding

Sources, most specific first: agent_grant (an explicit credential assign), agent_binding, crew_binding, workspace_binding, crew_link (no binding — delivered under the credential’s own name).

`crewship credential test`

Test a credential value against the provider API without saving it.

crewship credential test --provider ANTHROPIC --value sk-ant-...
crewship credential test --provider OPENAI --type API_KEY --value-stdin

Flag	Type	Default	Description
`--provider`	`string`	(required unless SECRET)	Provider name. Only `ANTHROPIC`, `OPENAI`, `GOOGLE`, `GITHUB`, `GITLAB`, `VERCEL`, `CURSOR` and `FACTORY` have a live probe; anything else answers “No validation available for this provider” rather than failing.
`--type`	`string`		Type: `API_KEY`, `AI_CLI_TOKEN`, `SECRET`, or `CLI_TOKEN`.
`--value`	`string`		Credential value to test.
`--value-stdin`	`bool`	`false`	Read value from stdin.

`crewship credential test-stored`

Re-test an already-saved credential against the provider API without re-supplying the value. Useful for verifying that a rotated key still works, or that a long-lived token has not been revoked upstream.

crewship credential test-stored <name-or-id>

Returns success if the live API call returns valid: true; otherwise the error message from the provider is printed. Crewship maintains upstream probes for Anthropic, OpenAI, Google, Cursor, Factory, GitHub, GitLab and Vercel, plus any ENDPOINT_URL credential. For every other provider there is nothing to call — the agent talks to that API directly and Crewship holds only the secret. Those credentials report not checked rather than valid, and exit 0:

Warning: Credential notion-key was not checked — Crewship has no upstream probe
for this provider. It is stored and will be delivered to agents as configured.

The distinction matters when scripting a pre-flight check: a “not checked” credential is neither known-good nor known-bad, so treat it as unverified rather than as a pass.

`crewship credential rotate`

Requires OWNER/ADMIN role, or the credential.rotate capability (grantable to a MANAGER/MEMBER so an oncall user can rotate a leaked token without full vault access). The new value is capped at 64 KiB. Issue a new value for the credential. The old value is preserved on the rotation row for the grace window (max 7d) so in-flight agents that cached the old key can still fall back during their run, then the old value is scrubbed. The cobra default for --grace-seconds is 0, but the flag is only sent when you explicitly set it. Omit the flag and the server applies its standard 24h grace. Pass --grace-seconds 0 to force an immediate cutover (no overlap). Pass any positive value (up to 604800 / 7d) to set a custom window.

crewship credential rotate gh-token --value sk_new_... --yes
echo "$NEW" | crewship credential rotate gh-token --value-stdin
crewship credential rotate gh-token --value-stdin --grace-seconds 0  # immediate cutover

Flag	Type	Default	Description
`--value`	`string`		New value (visible in `ps` — prefer `--value-stdin`).
`--value-stdin`	`bool`	`false`	Read new value from stdin.
`--grace-seconds`	`int`	`0`	Overlap window before the old value is scrubbed. Omit the flag for the server’s 24h grace; explicitly pass `0` for immediate cutover. Maximum `604800` (7 days).
`--auth-token`	`string`		`ENDPOINT_URL` only: new bearer token; omitting it drops the stored token.
`--header`	`KEY=VALUE` (repeatable)		`ENDPOINT_URL` only: extra request header.
`--yes`	`bool`	`false`	Skip confirmation.

`crewship credential rotations`

List rotation history for a credential.

crewship credential rotations <name-or-id>

Output columns: ID, STATUS, ROTATED_AT, EXPIRES_AT, GRACE_S, OLD_GONE, ROTATED_BY.

`crewship credential rotation-cancel`

End an ACTIVE rotation’s grace window immediately and scrub the old value. EXPIRED / CANCELLED rotations are no-ops on the server side (idempotent 200).

Scrubbing the old value ends the overlap window early — any in-flight agent still using the cached old key loses its fallback immediately.

crewship credential rotation-cancel <rotation-id>
crewship credential rotation-cancel rot_abc123 --yes

Flag	Short	Type	Default	Description
`--yes`	`-y`	`bool`	`false`	Skip confirmation prompt.

`crewship credential audit`

Show the full credential timeline — the same view the detail Sheet’s Audit tab uses. Useful for grep-ing for ROTATE / TEST / REVOKE events without scraping the UI.

crewship credential audit <name-or-id>
crewship credential audit anthropic-key --limit 200

Flag	Type	Default	Description
`--limit`	`int`	`50`	Number of entries to return. Range: 1–500.

`crewship credential default-env-var`

Print the conventional env var name for a provider (GH_TOKEN, GITLAB_TOKEN, VERCEL_TOKEN, …). Useful when scripting credential assign and you don’t want to memorise every provider’s convention.

crewship credential default-env-var --provider GITHUB
crewship credential default-env-var --provider GITLAB

Flag	Type	Default	Description
`--provider`	`string`	(required)	Provider name.

This is a suggestion, not a rule. Crewship accepts any provider string; one it has no convention for simply prints nothing and exits non-zero, and you pass --env-var-name yourself. Every name below is the variable the vendor’s own CLI or SDK documents reading.

Provider	Env var	Read by
`ANTHROPIC`	`ANTHROPIC_API_KEY`	Anthropic SDKs, Claude Code
`OPENAI`	`OPENAI_API_KEY`	OpenAI SDKs
`GOOGLE`	`GOOGLE_API_KEY`	Google Gen AI SDK (Gemini)
`HUGGINGFACE`	`HF_TOKEN`	`huggingface_hub` / `hf`
`PERPLEXITY`	`PERPLEXITY_API_KEY`	Perplexity API
`REPLICATE`	`REPLICATE_API_TOKEN`	Replicate SDKs
`ELEVENLABS`	`ELEVENLABS_API_KEY`	ElevenLabs SDKs
`OLLAMA`	`OLLAMA_HOST`	`ollama` (an endpoint, not a secret)
`AWS`	`AWS_ACCESS_KEY_ID`	`aws`, AWS SDKs
`GCP`	`GOOGLE_APPLICATION_CREDENTIALS`	Application Default Credentials (path to the service-account JSON)
`AZURE`	`AZURE_CLIENT_SECRET`	Azure Identity `EnvironmentCredential`
`CLOUDFLARE`	`CLOUDFLARE_API_TOKEN`	`wrangler`
`VERCEL`	`VERCEL_TOKEN`	`vercel`
`NETLIFY`	`NETLIFY_AUTH_TOKEN`	`netlify`
`RAILWAY`	`RAILWAY_TOKEN`	`railway`
`DIGITALOCEAN`	`DIGITALOCEAN_ACCESS_TOKEN`	`doctl`
`HEROKU`	`HEROKU_API_KEY`	`heroku`
`SUPABASE`	`SUPABASE_ACCESS_TOKEN`	`supabase`
`PULUMI`	`PULUMI_ACCESS_TOKEN`	`pulumi`
`KUBERNETES`	`KUBECONFIG`	`kubectl` (a path — mount as a file credential)
`NGROK`	`NGROK_AUTHTOKEN`	`ngrok`
`GITHUB`	`GH_TOKEN`	`gh` (checked before `GITHUB_TOKEN`)
`GITLAB`	`GITLAB_TOKEN`	`glab`
`NPM`	`NPM_TOKEN`	`.npmrc` via `${NPM_TOKEN}`
`SLACK`	`SLACK_BOT_TOKEN`	Slack Bolt SDKs
`NOTION`	`NOTION_API_KEY`	`@notionhq/client`
`LINEAR`	`LINEAR_API_KEY`	Linear SDK
`STRIPE`	`STRIPE_API_KEY`	`stripe`
`SENTRY`	`SENTRY_AUTH_TOKEN`	`sentry-cli`
`DATADOG`	`DD_API_KEY`	Datadog agent / `datadog-ci`
`TWILIO`	`TWILIO_AUTH_TOKEN`	`twilio`, Twilio SDKs
`SENDGRID`	`SENDGRID_API_KEY`	SendGrid SDKs
`RESEND`	`RESEND_API_KEY`	Resend SDKs

DOCKER, TERRAFORM, ANSIBLE, CUSTOM_CLI and NONE are recognised providers with no entry: the docker CLI authenticates through ~/.docker/config.json rather than an env var, and HCP Terraform’s token variable is host-suffixed (TF_TOKEN_<hostname>), so any single value here would be invented.

Storing the credential is only half the job — the CLI that reads it has to exist in the crew’s container. crewship crew credential-readiness reports which of a crew’s credentials are missing their tool.

`crewship credential reveal`

Disclose a credential’s plaintext value.

Try rotate first. Most reasons to reveal a secret are really reasons to put a new secret somewhere. crewship credential rotate shows the new value once while the old one drains through its grace window, so nothing currently in use is ever exposed. Reveal is the fallback for when you need the value that is already deployed.

crewship credential reveal gh-token --reason "Migrating the deploy key to Vault, ticket OPS-812"
crewship credential reveal deploy-key --reason "..." > deploy_key.pem

This command asks for your password. It cannot use your stored CLI token: the server refuses API tokens, internal/sidecar tokens and every non-interactive caller on this endpoint, because a token in a config file is indistinguishable from one held by a compromised agent or a leaked CI secret. The command signs you in interactively — creating a real session you can see in Settings → Sessions — and calls the endpoint with that. It also refuses to run without a terminal, before making any network call, so a CI job gets an actionable error instead of a password prompt it can never satisfy. The value goes to stdout and nothing else does, so it redirects and pipes cleanly. The credential name, its classification and the id of the journal entry now recording the disclosure go to stderr. A reveal is refused unless all of these hold:

an OWNER has enabled reveal for the workspace (crewship credential reveal-policy --enable)
your membership carries the credentials:reveal capability — being OWNER or ADMIN is necessary but not sufficient, and the capability is in no role bundle
you are MANAGER or above; a MANAGER is additionally limited to credentials in their own crews
the credential is not SEALED (see sensitivity)
your --reason is at least 20 characters and not a generic placeholder
the reveal can be written to the tamper-evident audit chain — if that write fails the command gets a 500 and no value

A credential in another workspace returns “not found”, not “forbidden”: the existence of an id in someone else’s tenant is not disclosed.

Flag	Type	Default	Description
`--reason`	`string`	(required)	Why you need the value. Minimum 20 characters, recorded verbatim in the audit log. `test`, `debug`, `n/a` and a single word repeated to length are rejected.

The endpoint has its own per-IP rate limit (http.cred_reveal_per_min, default 3/min), and unlike the general API bucket, authenticated CLI callers are not exempt from it.

`crewship credential reveal-policy`

Show or set the workspace credential-reveal switch. Reveal is off for every workspace — including newly created ones — until an OWNER turns it on.

crewship credential reveal-policy            # show current state
crewship credential reveal-policy --enable   # OWNER only
crewship credential reveal-policy --disable  # OWNER only

Reading requires MANAGER or above; MEMBER and VIEWER get a 403, because whether a tenant has reveal enabled is useful to an attacker choosing a target. Changing it requires OWNER. Both directions are written to the tamper-evident audit chain before taking effect: if the audit write fails, the switch does not move.

Enabling the switch grants nobody reveal on its own. Each person still needs the credentials:reveal capability on their membership. The recommended corporate default is two people holding it, not the whole admin team.

Flag	Type	Default	Description
`--enable`	`bool`	`false`	Turn reveal ON for this workspace.
`--disable`	`bool`	`false`	Turn reveal OFF for this workspace.

`crewship credential sensitivity`

Set a credential’s classification. It is the first thing the reveal gate consults and the only layer no role can override.

crewship credential sensitivity prod-db SEALED
crewship credential sensitivity gh-token RESTRICTED

Class	Reveal	Typical contents
`STANDARD`	With the full ceremony	Dev tokens, read-only keys
`RESTRICTED`	With the full ceremony	Production API keys, deploy keys
`SEALED`	Never, by any role, including OWNER	Production databases, root credentials, anything an agent created

Raising a classification is a MANAGER+ action and takes effect immediately — it only ever removes reach, so it needs no ceremony, and a control that is annoying to tighten stops being used. Lowering requires OWNER or ADMIN and is written to the audit chain first: it hands out a key that did not exist a moment earlier, and it is the cheap move for an attacker holding an admin session. SEALED has no escape hatch on purpose. To get a usable value out of a sealed credential, rotate it — crewship credential rotate mints a new one and shows it once. Existing credentials are STANDARD, which is safe only because the workspace reveal switch defaults to off.

RESTRICTED behaves like STANDARD today. The four-eyes second-approver flow that will distinguish them is deferred, but classifying now still pays off — that gate will key off this field.

Getting started

Sessions & identity

Agents & conversations

Crews, projects & workspaces

Missions & routines

Issues & triage

Skills & integrations

Inbox & notifications

Memory & journal

Observability

Cost & paymaster

Approvals & hooks

Configuration & system

Utilities

Credential Commands

crewship credential

Subcommands

`crewship credential list`

`crewship credential get`

`crewship credential create`

`crewship credential update`

`crewship credential delete`

`crewship credential assign`

`crewship credential unassign`

`crewship credential field`

`crewship credential bind`

`crewship credential bindings`

`crewship credential unbind`

`crewship credential resolve`

`crewship credential test`

`crewship credential test-stored`

`crewship credential rotate`

`crewship credential rotations`

`crewship credential rotation-cancel`

`crewship credential audit`

`crewship credential default-env-var`

`crewship credential reveal`

`crewship credential reveal-policy`

`crewship credential sensitivity`

​crewship credential

​Subcommands

​crewship credential list

​crewship credential get

​crewship credential create

​crewship credential update

​crewship credential delete

​crewship credential assign

​crewship credential unassign

​crewship credential field

​crewship credential bind

​crewship credential bindings

​crewship credential unbind

​crewship credential resolve

​crewship credential test

​crewship credential test-stored

​crewship credential rotate

​crewship credential rotations

​crewship credential rotation-cancel

​crewship credential audit

​crewship credential default-env-var

​crewship credential reveal

​crewship credential reveal-policy

​crewship credential sensitivity

crewship credential

Subcommands

`crewship credential list`

`crewship credential get`

`crewship credential create`

`crewship credential update`

`crewship credential delete`

`crewship credential assign`

`crewship credential unassign`

`crewship credential field`

`crewship credential bind`

`crewship credential bindings`

`crewship credential unbind`

`crewship credential resolve`

`crewship credential test`

`crewship credential test-stored`

`crewship credential rotate`

`crewship credential rotations`

`crewship credential rotation-cancel`

`crewship credential audit`

`crewship credential default-env-var`

`crewship credential reveal`

`crewship credential reveal-policy`

`crewship credential sensitivity`