#Provider credentials

When you sign in to Claude or Codex inside a chatspace, that creates a credential — the token that lets the agent act on your account. Chatspaces can securely save that credential so you don't have to sign in again on every new chatspace. This page explains how it's protected and how to opt out.

#Why save it at all

Without saving, you'd re-authenticate every single time you start a chatspace. Saving your agent login once means new chatspaces just work — they reuse it and skip the sign-in step.

It's your choice whether to save it, and you can change your mind.

#How it's protected

If you let Chatspaces save your agent login, it's handled with care at every step:

Encrypted at rest. Credentials are encrypted before they're stored. A stolen database backup would yield ciphertext, not your tokens.
Decrypted only when needed. They're decrypted on our servers only at the moment a chatspace starts, to hand them to the agent.
Not left lying around. On the machine they exist only for the running session, readable only by your own agent process — they aren't part of any snapshot or kept after the session.
Kept out of logs. Credential-shaped data is scrubbed from logs, so a token can't leak into a log line.
Never shown back to you. Like environment secrets, there's no screen that reveals a saved credential.
Access is audit-logged. Every read and write of a stored credential is recorded.

The same protections apply to the secrets in your environments.

#Opting out

You don't have to let Chatspaces save your agent login. If you opt out:

Nothing is stored — the credential isn't kept after your session.
You'll sign in to the agent each time you start a chatspace (the quick link / device-code flow).
Everything else works exactly the same.

You can opt out when you're first asked, or change the setting later in the app's privacy/account settings. Opting out later means future chatspaces won't reuse a saved login.

Note

Opting out doesn't reduce what the agent can do once you've signed in for that session — it only controls whether your login is remembered for next time.

#Revoking from the source

You can always revoke access from the provider directly — sign out or rotate credentials in your Claude (Anthropic) or ChatGPT (OpenAI) account. If a saved login stops working for any reason, the next chatspace simply asks you to sign in again.

← Previous Plans & billing Next → Troubleshooting