Authentication

The mode is set by the auth block in the profile. Profiles contain no raw secrets — they live outside git.

Mode	What happens
inherit (default)	agenix doesn't interfere: the executor uses its own configuration
subscription	the executor's native OAuth login (Claude Pro/Max, ChatGPT, Google, qwen.ai)
api-key	a key by name from ~/.agenix/credentials.yaml (0600)
env	a key from the environment variable apiKeyEnv (handy in CI)

Protection against accidental billing

For Claude Code and Codex, an API key in the environment overrides the subscription: if ANTHROPIC_API_KEY is lingering in the env, billing silently moves from the subscription to the API. So in every mode except inherit, agenix scrubs conflicting variables from the child process environment and injects only what the profile specifies.

Commands

agenix auth set litellm          # store a key (read from stdin)
agenix auth list                 # key names (values are not shown)
agenix auth remove litellm
agenix auth login codex          # native subscription OAuth
agenix auth status -p profile.yaml   # the profile's auth readiness

Subscriptions are available for claude-code, codex, qwen-code, gemini-cli; the remaining executors work with keys only.