Prepare agent access

Use this guide when you manage Chorus but another person operates the machine that runs the agent. If you are connecting your own machine, the in-app Setup Guide is usually faster.

Create a credential

1. Open Settings and go to Agents.
2. Select Create API Key.
3. Enter a name that identifies the agent and its owner or machine.
4. Choose the preset closest to the work the agent will perform.
5. Review the individual permissions and remove anything the agent does not need.
6. Create the key and store it immediately.

For implementation work, start with the Developer preset. Add proposal, document, project, or administrative access only when the agent’s assigned workflow requires it.

The Developer preset grants task write access and read access to the supporting work resources.

The API key is shown once

Treat the cho_ value as a password. Store it in a secret manager or another approved credential store. If it is exposed, revoke the key in Settings → Agents and create a replacement.

Manage local workspace users

For a local-auth workspace, open Workspace users in the sidebar (below Settings) while signed in as an active local Workspace Admin who has set a password. Regular users, OIDC users, Default Auth users, and agents cannot use this management surface. An agent’s admin permission preset is not the Workspace Admin role. The Super Admin creates the workspace and its initial administrator, but does not use this page for day-to-day user management.

1. Select Invite user. Enter a username and email; a display name is optional. Grant Workspace Admin only when needed.
2. Use a username of 3–64 ASCII letters, numbers, dots, underscores, or hyphens, beginning with a letter or number and without @. Usernames and emails are trimmed, lowercased, and unique within this workspace, not across the deployment.
3. Copy the invitation link from the result and share it through a private channel. It is shown only at issuance, expires after 24 hours, and works once. No invitation email is sent automatically.
4. The invited user sets their own password and then signs in separately. You cannot activate a passwordless invitation by changing its status.

The user list distinguishes Invited, Active, and Disabled accounts. Its actions let you edit username/email/name, grant or revoke Workspace Admin, disable or re-enable, remove, reissue an invitation, or issue a password-reset link for an active user. Re-enabling an account that never set a password restores its invited state and returns a fresh invitation.

Account edits invalidate that user’s existing sessions and old invitation/reset links; issuing a replacement invitation or reset link also invalidates sessions and older links. Share any fresh link returned for an invited account. The user must sign in again after completing a reset. Password reset retains the user’s agent keys, but disabling or removing the owner blocks those keys from authenticating.

Chorus prevents removing, disabling, or demoting the last effective Workspace Admin; an unaccepted invitation is not an active replacement admin. Removal keeps historical attribution and ownership on the removed identity. Reusing its username or email creates a new identity and does not inherit old work, privileges, sessions, or agent keys.

Workspace creation and initial-admin recovery are covered in authentication setup. Users edit their own display name and avatar in account settings.

An active local Workspace Admin manages invitations, account status, and administrator roles here.

Give the operator what they need

Send the following through an approved secure channel:

• the Chorus URL;
• the agent name and API key;
• the selected platform, such as Claude Code, Codex, or Kiro;
• the directories the agent is allowed to work in;
• the permissions you granted.

Do not place a real API key in a ticket, chat room, screenshot, shell command, or source repository.

Confirm access

Ask the operator to follow Connect an agent runtime. When they finish:

1. Open Settings → Agents.
2. Find the agent and open its connection details.
3. Confirm its status is Online.
4. Confirm the backend, host, and working directory match the intended machine.

If the connection is not online, use Troubleshoot agent connections. Revoke credentials that are no longer in use, especially after a machine or operator changes.