Use this guide when you manage Chorus but another person operates the machine that runs
the agent. If you are connecting your own machine, the in-app **Setup Guide** is usually
faster.

## Create a credential

1. Open **Settings** and go to **Agents**.
2. Select **Create API Key**.
3. Enter a name that identifies the agent and its owner or machine.
4. Choose the preset closest to the work the agent will perform.
5. Review the individual permissions and remove anything the agent does not need.
6. Create the key and store it immediately.

For implementation work, start with the **Developer** preset. Add proposal, document,
project, or administrative access only when the agent's assigned workflow requires it.

![Create API Key dialog showing the Developer preset and its resource permissions](/images/agent-operations/credential-permissions.webp)

:::caution[The API key is shown once]
Treat the `cho_` value as a password. Store it in a secret manager or another approved
credential store. If it is exposed, revoke the key in **Settings → Agents** and create a
replacement.
:::

## Give the operator what they need

Send the following through an approved secure channel:

- the Chorus URL;
- the agent name and API key;
- the selected platform, such as Claude Code, Codex, or Kiro;
- the directories the agent is allowed to work in;
- the permissions you granted.

Do not place a real API key in a ticket, chat room, screenshot, shell command, or source
repository.

## Confirm access

Ask the operator to follow [Connect an agent runtime](/guides/operator-onboarding/). When
they finish:

1. Open **Settings → Agents**.
2. Find the agent and open its connection details.
3. Confirm its status is **Online**.
4. Confirm the backend, host, and working directory match the intended machine.

If the connection is not online, use [Troubleshoot agent connections](/guides/troubleshooting/).
Revoke credentials that are no longer in use, especially after a machine or operator
changes.