Your credential runs your mission, or the mission does not run.

Connect an Anthropic API key under Settings, Connections. A mission runs on it or does not run. The refusal path is concrete: a tenant with nothing connected gets one activity on the issue saying the mission did not start, no repository claim and no model run. Softwerk's own platform key is a fallback for Softwerk's internal tenants only, and a kill switch can turn even that off. A stored OpenAI key is a connection, not a mission engine; the fleet runs missions on Anthropic credentials today.

The fleet holds no tenant secret at rest. Per task it asks the web app for exactly one credential over a request signed with an HMAC bound to tenant, mission and role and to a purpose (model, github or tracker). The answer comes back sealed: AES-256-GCM under an HKDF-derived key, a single-use nonce with replay protection in a Redis store, and the signed request as associated data, so a captured reply cannot be replayed for another tenant, another mission or another purpose. In production the broker refuses to issue without the replay store. Inside the executor pod the model subprocess runs as a second uid and sees only an allowlist of variables, so even the runner's environment is not the model's.

Every run page states which credential it ran on: tenant API key, tenant subscription, or platform. The API exposes the same value as credentialSource. A run dispatched before the broker existed reads "not recorded" rather than guessing. The same page shows the model cost of the role turns that reported what they spent, priced against a stored rate table so an amount stays reproducible after the table changes. There is no spend cap; your Anthropic console is the cost control.

The fleet never uses a personal access token. It mints a short-lived installation token per task from your own installation, scoped to the one repository the mission names, so GitHub itself refuses a repository you did not install on. Pull requests are opened by the App bot, under your installation, in your organisation.

Map a Linear team to a repository from the Connections page; the mapping creates the factory project, so there is no second tracker to maintain. Assign or mention an issue and a mission starts. Every role's activity, every gate question and every decision lives on the issue: a state change, a reaction on the gate's own comment or a threaded reply is a gate decision. The tracker token the fleet uses to write there is your app actor token, issued per turn through the same broker.

Projects can register their own MCP servers over https with a tool allowlist, an egress allowlist and a Secrets Manager ARN, never a secret value, and enable plugins per project. The registry is an operator switch: it stays dormant until TENANT_SECRET_PREFIX is set for the deployment.

Credential values are envelope-encrypted at rest and never returned to the browser; the UI shows that a connection exists, read from the table on every request. Per-tenant data keys that can be crypto-shredded are an operator switch (PER_TENANT_DEK_ENABLED); the shipped default is the master-key envelope.

AWS Bedrock roles, federated identity, multi-key pools with failover, and deployment into your own AWS account are planned and not live. Softwerk runs in its own AWS account today. The code accepts a subscription token as a credential and records such a run as having run on the tenant's subscription; what Softwerk offers is a mission on your own API key.