Question
Acknowledged

Which credentials should I clean up before transferring an Agent to another Space?

Yi C

The transfer guide says configuration and Drive move with the Agent, while channel connections need to be reconnected.

If I'm preparing an Agent for a client and it has used my own API keys and logins, where should I check before transferring it? Do environment variables, configuration files, and browser login state need separate attention? I'd like to put together a pre-handoff checklist.

Report
Kelly
Team

Treat a Buda Agent you are handing to a client as a complete bundle of configuration, Drive files and history. The transfer guide says those move with the Agent, so check more than the current chat before transferring it:

  1. Secrets: inspect Agent environment variables, Drive configuration files and scripts, Skill files, and old Session messages/attachments for your API keys, database URLs, SSH credentials or tokens. Remove local copies and revoke or rotate the original credentials at their providers.
  2. Connections and browser logins: review connected integrations, GitHub installations, channels, and personal accounts signed in within the cloud browser. Disconnect what the client should not inherit and revoke website sessions where appropriate. Do not assume moving the Agent clears browser cookies or third-party grants; let the client connect its own accounts in the target Space.
  3. Data and history: inspect the Agent Drive, references to shared-space folders, produced files, and old Session transcripts for internal information the client should not see. Stop active or scheduled work and keep only approved client material and Skills.

Before transfer, test the cleaned Agent in the source Space as a low-permission member, checking what it can read and call. Verify the target Space permissions immediately after the formal transfer, then let the client connect its own accounts; do not treat the transfer as an easily reversible test. If you cannot establish that history and browser state are clean, a new Agent containing only client-approved material is safer than transferring an old one. Are personal API credentials or confidential chat history your main concern? The Chinese discussion has the same checklist.

Report

Your reply

Sign in to join the discussion. Reading is always open; you only need an account to post.

Sign in