Command lineCommands

Credentials

The GitHub, GitLab and Bitbucket tokens of a project, which its agents clone repositories, sign commits and open pull requests with. The panel does the same on the Credentials tab of a project.

Who can do it

Any member of the project.

Step 1: List the credentials

The command shows each token with its kind, server, account, last characters, the result of its verification and when it expires. No command prints the token itself.

$ kcloud credentials list --project sandbox

Output

LABEL   KIND        SERVER              ACCOUNT  FINGERPRINT  VERIFIED  EXPIRES                   ID
GitHub  github_pat  https://github.com  acme-ci  a5e1         valid     2026-03-14T09:30:00.000Z  0195a3c4-7e21-7b6d-9f40-3c81a4d2e600

Step 2: Add a GitHub token

Without --kind the command stores a github_pat. It reads the secret from a file (--secret-file), from stdin (--secret-stdin), from the variable KCLOUD_SECRET, or asks for it. The platform checks the token with the provider at once.

$ kcloud credentials add --project sandbox --label "GitHub CI" --secret-stdin < github-token.txt

Output

Stored GitHub CI (c1b2) as 0195a3c4-7e21-7b6d-9f40-3c81a4d2e600.

Store a GitLab token with --kind gitlab_token and a Bitbucket token with --kind bitbucket_token. --server-url gives the server, https://gitlab.com or https://bitbucket.org by default, as in kcloud credentials add --project sandbox --kind gitlab_token --label "GitLab" --server-url https://gitlab.example.com --secret-file gitlab-token.txt. A Bitbucket Cloud account API token needs --account-email. --commit-name and --commit-email together give the identity the agent signs its commits with; without them the platform takes it from the provider. Bitbucket does not report one, and kcloud credentials list reminds you of a token without an identity.

Step 3: Rename a credential

The label names the token in the panel and in the commands of kcloud.

$ kcloud credentials rename "GitHub CI" --project sandbox --label "GitHub bot"

Output

The credential is GitHub bot now.

Step 4: Replace a token

With --restart-agents the platform restarts the agents that use the token, so they take the new one.

$ kcloud credentials rotate "GitHub bot" --project sandbox --secret-stdin < github-token.txt

Output

Rotated GitHub bot to c1b2.

Step 5: Verify a token

The platform checks the token with its provider again. A token that fails its verification raises a notification for the members of the project.

$ kcloud credentials verify "GitHub bot" --project sandbox

Output

The instance is verifying 0195a3c4-7e21-7b6d-9f40-3c81a4d2e600; kcloud credentials list shows the answer.

kcloud credentials usage <credential> --project <project> shows the usage of a Claude subscription only for a Claude Code OAuth token stored in a project. Claude accounts belong to the organization now, so kcloud claude-accounts usage shows their usage, and for a GitHub token the command answers that there is nothing to show.

Step 6: Set the commit identity

The name and the e-mail address the agent signs its commits with in the repositories of this token. A Bitbucket token needs them, and so does a GitLab account that hides its e-mail address. The agents that use the token take the new identity after a restart.

$ kcloud credentials set-identity "GitHub bot" --project sandbox --commit-name "Anna Nowak" --commit-email anna.nowak@example.com

Output

GitHub bot signs commits as Anna Nowak <anna.nowak@example.com> now.

Step 7: Delete a token

The platform deletes only a token that no agent uses.

$ kcloud credentials delete "GitHub bot" --project sandbox --yes

Output

Deleted the credential GitHub bot.

Claude accounts Repositories

Matches the panel at cloud.kikimora.dev.