Secrets & providers

Some flows need your agent to hold a credential — a plain secret (API key, token) or an OAuth connection to a model provider. Both happen on a one-time, token-gated link you're handed when the flow starts; there's no dashboard page to visit.

Save a plain secret

If the link is for a plain credential, you land on Secure Secret Entry — the name (and description) tells you what's being asked for. Paste the value and select Save Secret. The link works once; a spent or expired one shows "This link has already been used." or "This link has expired." — re-trigger the request in your agent for a fresh link.

Connect a provider (Claude / Codex / Gemini)

If the link is an OAuth connection to Claude (Anthropic), OpenAI Codex, or Google Gemini, it's a two-step flow, and Deva auto-refreshes the token so the agent never has to re-authenticate:

1. Authorize — select Authorize with Anthropic / OpenAI / Google; the provider's consent page opens in a new tab. After authorizing, copy the full URL from your browser's address bar (the page may show a connection error — that's expected; you're copying the callback URL, not visiting a working page).
2. Paste the callback URL (or authorization code) back on the Deva page and select Connect.

Gemini: use your own GCP project (recommended)

Gemini offers an optional GCP Project ID field — supplying your own project avoids provider trial limits and is required for organization / Google Workspace accounts. Create or pick a project at console.cloud.google.com, enable the Gemini for Google Cloud API, then paste the project ID before connecting.

Next steps

• API keys
• The resource rail