Skip to main content
Some providers — GitHub Copilot is the canonical example — expect OAuth instead of a static API key. Fleet Prime Agent handles the flow through /login and refreshes tokens dynamically for long-running sessions.

​
Sign in

Pick a provider that supports OAuth. The runtime walks the flow and stores the resulting OAuthCredentials. Files land in ~/.prime/agent/auth.json (mode 0600). Not every provider supports OAuth — for those you’ll be asked for an API key instead. See Providers and models for the mix.

​
Token refresh

Providers rotate OAuth tokens. Fleet Prime Agent resolves credentials dynamically with getApiKey on every provider call so long-running sessions keep working even when a token expires mid-run. Callers never see a stale token.

​
Storage caveats

packages/ai used to persist OAuth credentials itself. Storage was removed from the AI layer; each caller is responsible for persisting credentials themselves. In practice you use auth.json through the standard FileAuthStorageBackend. If you build a custom integration on top of packages/ai directly, wire storage up yourself.
  • Configuration — auth.json layout, permissions, env var overrides.
  • Security — trust model and credential handling.
Last modified on August 17, 2026