Held Credentials

Yours, for other services. Link keeps and uses them, and mints none.

Each, where it lives and who reads it

What each held credential is, where Link keeps it, and which program reads it.

A harness's token

A native harness can keep an endpoint or gateway token across starts. Its adapter lists where it is held and what it authorizes without printing its value, separately from the model keys the harness uses.

A model's key

The provider's variable, LNK_FALLBACK_CREDENTIAL for a fallback, or asked for by lnk agent start. It lives in your secrets (AGENT_<AGENT>_MODEL_KEY, …_FALLBACK_CREDENTIAL), granted to the agent by its ID, and the harness's own .env (DeepSeek Harness's store of keys). The harness reads it, or the sandbox's proxy where it adds the key outside (Secrets).

A connection's token

From lnk agent connect: its variable, or asked for. It lives in your secrets (AGENT_<AGENT>_<CONNECTION>_<FIELD>), as a model's key does, and the connection's bridge reads it, outside the sandbox.

A tool's key and a remote tool's headers

A tool's key (a search service's, as BRAVE_API_KEY) lives in the tool's settings (lnk sandbox tool), mode 600, and the tool sends it to its service alone. A remote tool's headers (lnk sandbox tool add --header-file) live in the tool's settings, mode 600, read by the tool outside every sandbox.

An export's headers

From lnk measure export --header-file: they live in the watcher's settings, mode 600, and the watcher sends them to its endpoint alone.

A cloud account's keys

From lnk cloud connect: they live in the Keychain, else accounts.toml, mode 600, and lnk box and lnk bucket read them.

A bucket's keys and encryption password

They live in the Keychain, else rclone's settings, read by lnk bucket, and by the files bridge for an agent's folder.

A storage token that refreshes itself

The storage bridge's: a token of minutes and what gets the next, kept in the bridge's memory and handed to the bridge outside every sandbox, so the bridge never holds a cloud's own sign-in.

A secret you keep

From lnk secret create: it lives in the Keychain on a Mac; on Linux the keeper's store, else ~/.lnk/secrets.toml, mode 600, with how it's given (a sealed one's host) and where it's granted. Only what its grants name reads it: an agent granted it, sealed, through its sandbox's proxy, which adds it for its host alone (Secrets).

When saved secrets cannot be read

The credential viewer reports an unreadable store as a status without claiming to know its contents. It exposes no secret value and keeps the failure distinct from an empty store or a known individual credential.

Link makes an SSH key for reaching the boxes it creates and keeps the private half on this machine. Boxes trust it only with a short-lived certificate the box SSH secret signs; credential views describe its location and access without printing it.

The box SSH secret

The secret half of this machine's SSH certificate authority, which signs the certificates boxes trust, kept in the Keychain on a Mac, else in a file of the user's alone. The public half is installed on each box at its first boot; credential views describe where the secret is kept without printing it.

How they're kept

What holds for every held credential.

Never on a command line, never in output

A held credential reaches the program that uses it as a file or on standard input, never as an argument, and no describing command prints it.

A connection's token sent from the account service

It's sealed, as you ask for it, to the receiving machine's sealing key, for that machine's agent (<machine id>/<agent>) and connection, so the service never keeps it readable, and hands over only what's sealed. A machine whose lnk hasn't said what to seal to is asked no connect.

On the machine

The machine opens it, hands it to lnk agent connect on its pipe, and it's kept as a connection's token is.

Given only where it's granted

A secret you keep goes only to what lnk secret add gives it to, and the grant is kept with the value, never in a file that names it, so editing a file never widens it. An agent's grant is bound to its ID, never its name.

Gone with what it's for

An agent's keys go when it leaves the machine. A cloud account's go when the account is disconnected, and a bucket's with its section. A secret you keep goes with lnk secret delete, which also reaches each box a move sent it to, as the move noted before sending it. A box it can't reach stays noted, and remove fails until it reaches it (Secrets).