Credentials and configuration

Cloud-agent setup prepares your coding tools with the local configuration available to the CLI. Reusing an agent preserves its files and working provider credentials.

Three separate connections

Signing in to a model provider does not replace the OpenCode server password. An authenticated OpenCode connection can still need a provider account before it can answer a prompt.

Provider sign-in

Railway reads available provider credentials locally and transfers them over SSH. It does not put the provider credential in an image, a Railway environment variable, or the SSH command arguments. Working credentials already present on a reused agent are preserved.

With no local credential to copy or mint, the agent can still start. Complete the coding tool's sign-in on the remote machine. The CLI prints which local source it uses when one is available.

Claude tokens

Claude's local sign-in uses rotating credentials. Railway mints a separate token for the VM with claude setup-token, which can open a browser on your computer. The cached token is reused on subsequent launches.

To replace a revoked or failing token, target the agent's environment and run:

railway code --claude --refresh-auth

This clears the cached local and selected remote credential and runs the minting flow again. railway logout removes the cached local Claude token; upstream revocation is separate.

OpenCode accounts

The CLI copies your local OpenCode provider sign-ins to the agent. It transfers provider credentials only, not your local chats, sessions, or MCP credentials, and preserves credentials already configured on the agent.

To sign in directly, open a shell with railway ca ssh <agent-name> -- bash, then run opencode auth login. You can also connect a provider from the remote project in OpenCode.

OpenCode server authentication

Railway generates a username/password connection for the OpenCode server and checks it over HTTPS before reporting readiness. It prints these values for manual connection and, during Desktop setup, saves them in the selected app's settings.

The same agent reuses its saved server credentials on subsequent setup. Treat the printed password as access to your coding server and project files. It is separate from the provider credentials described above.

Sync your skills

Use railway ca setup to enable personal skill sync and choose a directory:

• ~/.claude/skills
• ~/.codex/skills
• ~/.grok/skills
• ~/.agents/skills
• ~/.config/opencode/skills

The CLI lets you select skills from the source. It packages eligible skill directories and uploads changes during launch. Existing names on the agent are preserved, including Railway's own installed skills. Disabling sync later leaves previously copied skills on the VM.

Packed skills over 2 MB produce a warning; over 10 MB fail before creating an agent. Bulk directories such as .git and node_modules, and environment files, are excluded.

Import project MCP configuration

Launch from your repository to import eligible servers from its .mcp.json. The CLI searches from the current directory toward the repository root. Disabled entries and servers managed by Railway are excluded, and imported names receive a user- prefix.

Import is enabled by default and can be disabled in ~/.railway/agent-prefs.json with "mcp": { "enabled": false }. The same preference can exclude specific server names. Existing servers outside the imported namespace are preserved.

The remote machine must be able to run a configured command or reach its server URL. A URL using localhost refers to the cloud agent when used there. Importing configuration does not copy every application's OAuth session.

Set variables

Variables are supplied when an agent is created. Pair them with --new:

railway code --codex --new --variable DATABASE_URL=postgres.DATABASE_URL

Values can reference other services in the same environment. See Variables for reference syntax.

Load variables from a file:

railway code --opencode --new --env-file .env.agent

Repeated --env-file inputs are supported; --variable overrides matching file entries. These options do not update an already running agent's environment.

Local Desktop configuration

railway ca desktop adds a managed entry to ~/.ssh/config. Claude also receives an entry in ~/.claude/settings.json. Codex discovers the SSH alias itself. OpenCode receives a server connection and remote project in its own Desktop store.

Use --dry-run to preview configuration, --ssh-config <path> to select a different SSH file, and --alias <name> to choose the host alias. Apps that read the default SSH file need access to the alternate configuration if you change it.

Setup preserves unrelated settings and backs up the files it changes. --remove removes the managed connection; it is separate from deleting the VM.

Desktop setup reference →