Credential handling

With Sandbox Workload Identity on, sandboxes hold no standing credential for your data. The setting is off by default, and then each sandbox holds two keys (see Without Sandbox Workload Identity). This page shows the three ways a credential is applied to a sandbox request and the few items a sandbox can read.

How credentials are applied

flowchart LR
  subgraph A["A. App-brokered"]
    a1["Agent sandbox<br/>no credential"] -->|API call, no key| a2["Application tier<br/>own credential ◆"] --> a3["Services the App calls<br/>Parallel, Composio, Box,<br/>connectors, Amazon S3, model gateway"]
  end
  subgraph B["B. Edge-injected (Sandbox Workload Identity on)"]
    b1["Agent sandbox<br/>placeholder model key"] -->|model request| b2["Egress proxy (Envoy)<br/>adds the key ◆"] -->|model key| b3["Model gateway (LiteLLM)"]
  end
  subgraph C["C. Direct link"]
    c0["Application tier<br/>signs drive links; relays links issued by Box ◆"] -->|short-lived link| c1["Agent sandbox<br/>holds the link"] -->|used directly| c3["Amazon S3 or Box<br/>one drive file, or a Box file transfer"]
  end

Pattern	How it works	Used for
A. App-brokered	The sandbox makes an API call with no key; the application tier uses its own credential ◆	Parallel, Composio, Box, connectors, Amazon S3, model gateway
B. Edge-injected	With Sandbox Workload Identity on: the sandbox holds a placeholder model key; the egress proxy (Envoy) adds the real key ◆ before forwarding to the model gateway. With it off (the default), the sandbox holds the model gateway key and calls the gateway directly	Model calls only
C. Direct link	The application tier signs drive links and relays links issued by Box ◆; the sandbox holds a short-lived link and uses it directly	Drive files fetched with a presigned link, and Box file transfers

Under a domain allowlist, pattern C needs the Amazon S3 and Box transfer domains in the egress allowlist. For Box, the installer’s help text names .boxcloud.com and upload.box.com (see Sandbox egress settings).

Items readable inside the sandbox

The items below are those of a sandbox with Sandbox Workload Identity on. With it off, the sandbox also holds the two keys in the next section.

Item	Scope	What it allows	If copied out	Severity
Placeholder model key	Constant	Nothing; the egress proxy replaces it	No effect	None
Approval-signing public key	Deployment	Verifying approvals; cannot create them	No effect	None
Drive client configuration	Constant placeholder	Nothing; the drive gateway identifies the sandbox by address	No effect	None
Delegation token	One run, 10 minutes	States which person the run acts for; accepted only after the sandbox is identified by address	No effect outside the sandbox	None
Drive file link (presigned)	One file, issued on request	Downloading or uploading that file directly from Amazon S3	Usable until it expires	Low
Box transfer link	One file, short-lived	Downloading or uploading that file	Usable until it expires	Low
Boot token (pooled sandboxes)	Deployment	Reading the sandbox start-up configuration (no customer data, no credentials)	Usable from your network unless internal-only paths are denied at the edge (S-05 *)	Low
Log-shipping token	Deployment	Writing log entries to Loki	Usable from your network; entries can be forged (S-06)	Medium

Sandboxes created by the Context release hold no Kubernetes token and no IAM role. With Sandbox Workload Identity on, they also hold no standing credential for the drive, the model gateway, Parallel, Composio or connectors; the items above are the exceptions.

Without Sandbox Workload Identity

Sandbox Workload Identity is off by default. With it off, each sandbox also holds these two keys in its environment:

Item	Scope	What it allows	If copied out	Severity
Context API key (`CONTEXT_API_KEY`)	This agent and task run; expires after 24 hours, and is revoked when the same sandbox starts again	Calling the Context API as the agent, within the agent’s own access	Usable from your network until it expires or is revoked	Medium
Model gateway key (`OPENCODE_LITELLM_API_KEY`)	The deployment’s key, or the workspace seat’s key where your gateway bills per seat	Model requests to your LiteLLM gateway	Usable from your network until rotated in your gateway	Medium

There is no placeholder model key and no egress proxy on the model path: the sandbox calls the model gateway directly. To remove both keys from the sandbox, turn on Sandbox Workload Identity (see Sandbox identity).

For how connector and integration tokens are stored and encrypted, see Connectors.