Keys

Add Claude, OpenAI, GitHub and GitLab keys to your key library, with exact steps to create each one, and see where each key is used.

In the appOrganisationKeys

The key library holds your organisation's AI keys (Claude, OpenAI) and code keys (GitHub, GitLab) in one place. Find it under Organisation › Keys.

You add a key once. Then each platform, repository and chatbot picks the key it uses:

each platform picks the Claude key its agent runs on, under Settings › Agent;
each repository picks its GitHub or GitLab key, under Settings › Code;
each chatbot picks the Claude or OpenAI key for its model.

Only owners and admins see Keys in the menu, and only they can add, replace or delete keys.

How keys are kept#

Keys are encrypted when you save them.
A saved key is never shown again, here or anywhere else. The list shows only its last four characters, such as "…a1b2".
A key can only be used by platforms in your own organisation.
Known key formats are hidden from tool output, error messages and logs before they're stored.

Add a key#

1
Go to Organisation › Keys.
2
Click Add key at the top right. In an empty group you can also click Add a Claude key or Add a code key.
3
In the pop-up, choose the Kind of key: Claude (the agent and chatbots), OpenAI (chatbots), GitHub or GitLab (reads your code there).
4
Give it a Name your team will recognise, such as Claude for support or GitHub read-only.
5
Paste the key into Value. The line under it says what kind of key to paste.
6
For GitLab on your own server, enter your server's address in GitLab server.
7
Click Save key.

Field	What it does
Kind of key	Which service the key is for.
Name	A label for your team. It's shown wherever you pick a key.
Value	The key itself. It's checked for the right start (Claude keys start with `sk-ant-`, OpenAI keys with `sk-`).
GitLab server	GitLab only. Leave it empty for `https://gitlab.com`. Change it only if you run your own GitLab.

The list and "Used by"#

Keys are in two groups, each a table: AI keys (Claude and OpenAI) and Code keys (GitHub and GitLab). A group with no keys says what's missing, with a button to add one.

Each row shows:

Key: an icon for the kind, the name, and a line under it with the kind. For Claude keys it says API key, or subscription, the agent only (not chatbots). For GitLab keys on your own server, it shows the server address;
Ending: the last four characters;
Used by: one chip for each platform that uses the key. Hover a chip to see what uses it there, such as the agent, a repository or a chatbot. Not used means nothing picks it;
Updated: when the key was last changed;
⋯: Rename or replace… and Delete.

Replace or rename a key#

Use this when a key expires, or to rotate it.

1
Open the ⋯ menu on the key and click Rename or replace….
2
Change the Name, or paste the new key into New value. Leave New value empty to keep the saved one.
3
Click Save.

Everything using the key switches to the new value at once. You don't need to pick it again anywhere.

Delete a key#

Open the ⋯ menu on the key, click Delete, then confirm with Delete key. The confirmation lists what uses the key. Those things stop working until you pick another key for them. For example, a platform whose agent key is deleted can't investigate new tickets.

How to create each key#

Claude API key#

The agent runs on Claude, so every organisation needs one Claude key.

1
Sign in at console.anthropic.com.
2
Make sure the account has credit. Open Billing and add credit or a payment method. Without credit, investigations fail with a message that the AI service refused the request.
3
Open API keys and click Create key. Give it a name, such as Cerberius Agents.
4
Copy the key straight away. It starts with sk-ant-api and is shown only once.
5
In Cerberius Agents, add it as kind Claude.

Subscription tokens

A Claude subscription token, starting with sk-ant-oat, is also accepted. It can run the agent, but it can't power chatbots. Chatbots need a Claude API key starting with sk-ant-api. For real work, we recommend an API key.

OpenAI API key#

OpenAI keys are only for chatbots that use an OpenAI model. The agent always runs on Claude.

1
Sign in at platform.openai.com.
2
Make sure the account has credit under Billing.
3
Open API keys and click Create new secret key.
4
Copy the key. It starts with sk- and is shown only once.
5
In Cerberius Agents, add it as kind OpenAI.

GitHub key (fine-grained personal access token)#

1
On github.com, open your avatar menu and go to Settings › Developer settings › Personal access tokens › Fine-grained tokens.
2
Click Generate new token.
3
Give it a Token name, such as Cerberius Agents, and choose an Expiration.
4
Set Resource owner to the organisation that owns your repositories.
5
Under Repository access, choose Only select repositories and pick the repositories the agent should read.
6
Under Permissions › Repository permissions, set Contents to Read-only. Metadata: Read-only is added for you.
7
If you want approved code fixes to open pull requests, set Contents to Read and write and Pull requests to Read and write instead.
8
If you want the agent to see your build pipelines (GitHub Actions), for example to tell you whether a fix built and deployed, also set Actions to Read-only.
9
Click Generate token and copy it. It starts with github_pat_ and is shown only once.
10
In Cerberius Agents, add it as kind GitHub. Then pick it for each repository under Settings › Code, and use Check access in the repository's ⋯ menu.

What you want	Contents	Pull requests	Actions
Investigations only	Read-only	No access	No access
Investigations and pull requests for approved fixes	Read and write	Read and write	No access
Either of the above, and the agent sees your builds	as above	as above	Read-only

Your GitHub organisation may need to approve the token

Some GitHub organisations require an owner to approve fine-grained tokens. Until they do, the token can't see the repositories. Check access then shows Can't read, with a reason that starts "Not found". Ask a GitHub organisation owner to approve it. They'll find it in the organisation's settings, under Personal access tokens › Pending requests.

Good habits:

Don't add other permissions, such as Workflows or Administration. The agent never changes CI files, so it doesn't need them. Actions: Read-only only lets it see build results. It can't start, re-run or cancel anything.
Use two keys if you like: a read-only key for most repositories, and a read-and-write key only where you want fixes.
Note the expiry date. When the token expires, investigations can't download your code. Make a new token and use Rename or replace… before then.

GitLab key (personal, project or group access token)#

Any of these works:

Personal access token: in GitLab, open your avatar menu, choose Edit profile, then Access tokens › Add new token.
Project access token: in the project, go to Settings › Access tokens › Add new token. One project only.
Group access token: in the group, go to Settings › Access tokens › Add new token. Every project in the group.

1
Give the token a name, such as Cerberius Agents, and an expiry date.
2
For project and group tokens, choose a role: Reporter is enough to read; choose Developer if you want merge requests for approved fixes.
3
Select the scopes from the table below.
4
Click Create and copy the token. It's shown only once.
5
In Cerberius Agents, add it as kind GitLab. If you run your own GitLab, set GitLab server to its address, for example https://gitlab.example.com.

What you want	Scopes
Investigations only	`read_repository` and `read_api`
Investigations and merge requests for approved fixes	`api`

read_repository lets the agent download the code. read_api lets Check access read the project's details, such as its default branch. api covers both, and lets the service create the branch and the merge request.

Agent settings: choose the agent's Claude key.
Repositories: choose each repository's key.
Secrets and your data: how we protect keys.