Skip to main content
Create a key from the agent’s Connect to Codex dialog. The secret is shown once. Store it in private client settings or a secret manager. The same tr_agent_… bearer credential works for MCP and the read-only REST API. Each key is limited to one agent and expires after 90 days. Transfer stores a hash of the key rather than the original secret.

​
Replace a key

Choose Replace key & show new code, then update every client that used the old connection. The previous key stops working immediately, including for existing clients.

​
Revoke access

Choose Revoke agent access in the connection dialog. Requests using that credential are rejected. Generate a new key to restore access. If a key is exposed, revoke or replace it immediately and remove it from wherever it was shared. Freezing a card blocks purchases but does not revoke read access. Agent keys cannot fund the wallet or change spending controls.