Credentials and rotation
| Credential | Where it belongs | Authority |
|---|---|---|
| Developer session | Console cookie or private CLI session file | Your account and owned projects |
| Project credential | Trusted backend or CI secret store | Deployment, keys, token exchange, runs, approvals |
| Provider key | Project Settings | Requests billed to your provider account |
| Customer session/token | Your customer’s app | That customer’s permitted runs, conversations, and data |
The project ID and API URL are public identifiers. The other values in this table are secrets.
Rotate a project credential
Section titled “Rotate a project credential”- Open the project’s Credentials page and create a named replacement.
- Copy the new secret once into your backend or CI secret store. Stead stores its hash and cannot display it again.
- Update the consumer and verify a read or deployment using the replacement.
- Revoke the old credential in the console.
Revocation stops subsequent requests using the old credential. It does not revoke every customer token that was already exchanged from it; those expire separately. The CLI’s saved developer session is independent of project credentials.
Replace the provider key
Section titled “Replace the provider key”Save the replacement in Settings. The response never echoes the key. Run getstead doctor --check-provider to test the saved key with a small billable request, then revoke the old key at the provider when appropriate for your other applications.
The CLI also supports getstead keys set --base-url https://api.openai.com/v1. It reads the key from STEAD_PROVIDER_KEY, or from piped stdin when that variable is absent or empty. It has no key argument because arguments can be visible to other processes.
An exported shell variable wins over piped stdin. The CLI does not automatically load .env. If you are rotating through a secret-manager pipe, remove an old inherited STEAD_PROVIDER_KEY from that command’s environment so it cannot select the previous key. Never echo a key to diagnose which one was chosen; check the provider account and the saved endpoint instead.
Lost session
Section titled “Lost session”Run getstead login to authorize the terminal again. getstead logout revokes its saved session. A developer password reset revokes existing sessions. A missing or unreadable CLI session file is not fixed by putting a project secret into frontend code.
If you lose a project credential, issue a replacement and revoke the old one; it cannot be recovered from the console. Provider keys similarly have no read-back endpoint.